ai-workspace-infra/iac_modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,148 Commits 3 Branches 2 Tags 21 MiB
217d94eb4b
Commit Graph

1148 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
shenlan
217d94eb4b
Update set-registry.sh 2025-04-08 11:18:01 +08:00
shenlan
ea8629dc84
Merge pull request #61 from svc-design/k3s-cluster 
refactor(k3s-cluster): use synchronize to run scripts
 2025-04-07 23:42:19 +08:00
Haitao Pan
429c2ace22 refactor(k3s-cluster): 
- move setup scripts to user tmp dir for safer execution
 2025-04-07 23:41:11 +08:00
Haitao Pan
8578142170 refactor(k3s-cluster): use synchronize to run scripts 2025-04-07 22:45:05 +08:00
shenlan
4aa7c8a378
Merge pull request #60 from svc-design/k3s-cluster 
Removed sub tasks: run secure_ssh.sh script
 2025-04-07 22:35:50 +08:00
Haitao Pan
548465ec1f Removed sub tasks: run secure_ssh.sh script 2025-04-07 22:34:55 +08:00
shenlan
1bf1fdf435
Merge pull request #59 from svc-design/k3s-cluster 
Update roles/vhosts/k3s-cluster
 2025-04-07 22:20:38 +08:00
Haitao Pan
5b1401e439 removed workflows: deplay-app-with-argocd.yaml 2025-04-07 22:20:14 +08:00
Haitao Pan
b758624ce4 Update roles/vhosts/k3s-cluster 2025-04-07 22:16:34 +08:00
shenlan
d0fc2cdae8
Merge pull request #58 from svc-design/vpn-overlay 
Vpn overlay
 2025-04-07 22:02:42 +08:00
Haitao Pan
c8988c397a refactor: replace disable-systemd-resolved with setup-systemd-resolved task 2025-04-07 22:01:43 +08:00
shenlan
384aab30d2
Update app-pipeline-renew-node-ssl-certs.yml 2025-04-07 21:32:51 +08:00
shenlan
325a9ce809
Merge pull request #57 from svc-design/k3s-cluster 
feat(k3s): add ansible role and playbook for K3s cluster setup
 2025-04-07 21:29:39 +08:00
Haitao Pan
43a4758a93 feat(k3s): add ansible role and playbook for K3s cluster setup 2025-04-07 21:26:06 +08:00
shenlan
d21d302639
Merge pull request #56 from svc-design/vpn-overlay 
feat: split and simplify systemd-resolved DNS configuration task
 2025-04-07 21:14:38 +08:00
Haitao Pan
d8ff3a79e2 feat: split and simplify systemd-resolved DNS configuration task 
- Disabled systemd-resolved and add static DNS setup
 2025-04-07 21:13:10 +08:00
shenlan
f4d92b0508
Merge pull request #54 from svc-design/vpn-overlay 
chore(config): update firewall and VPN overlay settings
 2025-04-07 20:11:40 +08:00
Haitao Pan
72e99501a1 chore(config): update firewall and VPN overlay settings 
- allow UDP 51820 for WireGuard
- remove 10.253.0.0/16 from allowed IPs in WireGuard site configs
 2025-04-07 20:10:49 +08:00
shenlan
1ca81f7ae7
Merge pull request #53 from svc-design/vpn-overlay 
Vpn overlay
 2025-04-07 15:41:37 +08:00
shenlan
d3c0ca69ec
Merge branch 'main' into vpn-overlay 2025-04-07 15:41:26 +08:00
Haitao Pan
954c3b26d9 chore(pulumi): add Pulumi.yaml for Modern Container App IaaS deployment 2025-04-07 15:40:02 +08:00
Haitao Pan
4d349ca572 feat(config): update master-1,slave-1 VPN Overlay IP 2025-04-07 15:31:53 +08:00
shenlan
7c54c045d4
Merge pull request #52 from svc-design/vpn-overlay 
feat(config): add WireGuard key pair config for deepflow-demo mainten…
 2025-04-07 13:35:19 +08:00
Haitao Pan
fcef8d55fd feat(config): add WireGuard key pair config for deepflow-demo maintenance 2025-04-07 13:33:45 +08:00
Haitao Pan
4afb39ccfb Update slave-1 br_ip: changed from 172.16.0.2 to 172.16.0.3 2025-04-06 19:42:41 +08:00
shenlan
aea056f04b
Merge pull request #51 from svc-design/vpn-overlay 
Vpn overlay
 2025-04-06 17:58:25 +08:00
Haitao Pan
5be8955ff5 feat: enhance WireGuard VPN Overlay deployment and DNAT support 
Changes:
- Fixed wg0.conf.j2 template variables
- Refactored wireguard/site logic to support dynamic peer/key selection
- Updated defaults, playbook entry, and install script for consistency

Tested:
✅ NodePort 443 + DNAT verified from master/slave nodes and external curl
 2025-04-06 17:50:32 +08:00
Haitao Pan
31c915eb1f feat(config): add ignore_files support to config loader 2025-04-06 13:36:28 +08:00
Haitao Pan
bd8553f20e feat(vpn-overlay): add WireGuard Site role 2025-04-06 13:29:01 +08:00
Haitao Pan
bfc960e4e9 feat(vxlan): support optional DNAT port mapping via EXPOSE_PORT 2025-04-06 12:28:58 +08:00
Haitao Pan
d38c4770ac feat: Add VXLAN over WireGuard support with site automation 
- Enabled VXLAN over L3 via WireGuard tunnel;
- Standardized Ansible role structure for `vpn-overlay`;
- Integrated systemd service management via `vxlan-setup.service`;
- Configured per-site VXLAN overlay in `config/sit/vpn-overlay.yaml`;
 2025-04-06 00:08:17 +08:00
shenlan
af211196f7
Merge pull request #50 from svc-design/vpn-overlay 
feat(ansible): improve Linux OS setup role (vhosts/common)
 2025-04-05 17:51:35 +08:00
Haitao Pan
cb8dda4fed feat(ansible): improve Linux OS setup role (vhosts/common) 2025-04-05 17:50:43 +08:00
shenlan
20d1491f0f
Merge pull request #49 from svc-design/vpn-overlay 
feat(ansible): add Linux OS setup role (vhosts/common)
 2025-04-05 17:48:16 +08:00
Haitao Pan
d7871dc331 feat(ansible): add Linux OS setup role (vhosts/common) 2025-04-05 17:46:23 +08:00
Haitao Pan
7a1b15416f add scripts/auto-fix-gitleaks.sh 2025-04-05 13:57:43 +08:00
shenlan
39bc469246 Merge pull request #48 from svc-design/iac_modules_pulumi-scripts 
feat(ansible): add dynamic inventory and ansible.cfg
 2025-04-05 12:43:21 +08:00
Haitao Pan
98a115b96f feat(ansible): add dynamic inventory and ansible.cfg 
- Add ansible.cfg for plugin config
- Enabled Pulumi passphrase auto-load in run.sh
- Add scripts/dynamic_inventory.py with --list, --host, --export-static
- Cleanup: remove legacy inventory.py
 2025-04-05 12:38:31 +08:00
shenlan
9d7d6160bc Merge pull request #47 from svc-design/vpn-overlay 
Vpn overlay
 2025-04-05 11:59:21 +08:00
Haitao Pan
ff5741f8df feat(vxlan): enhance setup_sit_vxlan.sh, add overlay_diag.sh and README 
- Changed parameter order: <dev_if> <local_ip> <remote_ip> <br0_ip> [cidr_suffix] [vxlan_id]
- Automatically apply CIDR suffix (/16 by default)
- Auto-trigger ARP learning with ping from veth
- Fixed SNAT to use dynamic interface instead of hardcoded eth0
- Added overlay_diag.sh to verify interface, FDB, VXLAN traffic and NAT status
- Added README.md with usage instructions and examples
 2025-04-05 11:46:19 +08:00
Haitao Pan
1f40718d3f Merge branch 'main' into vpn-overlay 2025-04-05 10:57:46 +08:00
shenlan
b3028191a2 Merge pull request #46 from svc-design/iac_modules_pulumi_ec2_utils 
feat: refine firewall rules and improve AMI resolution
 2025-04-04 21:38:37 +08:00
Haitao Pan
a06d872a75 feat: refine firewall rules and improve AMI resolution 
- Renamed and split firewall rules by VPC
- Refactored resolve_ami() to reduce duplication and improve extensibility
 2025-04-04 21:35:06 +08:00
shenlan
4e6c370d34 Merge pull request #45 from svc-design/iac_modules_pulumi_sg_rules 
feat(iac): support multi-VPC & multi-SG binding for EC2 instances
 2025-04-03 23:05:51 +08:00
Haitao Pan
9bcefe35a2 feat(iac): support multi-VPC & multi-SG binding for EC2 instances 2025-04-03 23:01:09 +08:00
Haitao Pan
f4a426c4c3 Merge branch 'main' into vpn-overlay 2025-04-03 21:34:23 +08:00
Haitao Pan
dbcb47cc07 git commit -m "feat(vxlan): implement safe vxlan + bridge overlay without eth0 bridging" 2025-04-03 21:33:42 +08:00
Haitao Pan
3263f37724 add vpn-overlay/vxlan/setup_sit_vxlan.sh 2025-04-03 21:16:43 +08:00
shenlan
d4d252a995 Merge pull request #44 from svc-design/iac_modules_pulumi_multi_vpc 
feat(vpc): auto-create and associate route tables based on subnet type
 2025-04-03 21:10:08 +08:00
Haitao Pan
c5a776dca2 feat(vpc): auto-create and associate route tables based on subnet type 2025-04-03 21:07:51 +08:00