shenlan
4aa7c8a378
Merge pull request #60 from svc-design/k3s-cluster
...
Removed sub tasks: run secure_ssh.sh script
2025-04-07 22:35:50 +08:00
Haitao Pan
548465ec1f
Removed sub tasks: run secure_ssh.sh script
2025-04-07 22:34:55 +08:00
shenlan
1bf1fdf435
Merge pull request #59 from svc-design/k3s-cluster
...
Update roles/vhosts/k3s-cluster
2025-04-07 22:20:38 +08:00
Haitao Pan
5b1401e439
removed workflows: deplay-app-with-argocd.yaml
2025-04-07 22:20:14 +08:00
Haitao Pan
b758624ce4
Update roles/vhosts/k3s-cluster
2025-04-07 22:16:34 +08:00
shenlan
d0fc2cdae8
Merge pull request #58 from svc-design/vpn-overlay
...
Vpn overlay
2025-04-07 22:02:42 +08:00
Haitao Pan
c8988c397a
refactor: replace disable-systemd-resolved with setup-systemd-resolved task
2025-04-07 22:01:43 +08:00
shenlan
384aab30d2
Update app-pipeline-renew-node-ssl-certs.yml
2025-04-07 21:32:51 +08:00
shenlan
325a9ce809
Merge pull request #57 from svc-design/k3s-cluster
...
feat(k3s): add ansible role and playbook for K3s cluster setup
2025-04-07 21:29:39 +08:00
Haitao Pan
43a4758a93
feat(k3s): add ansible role and playbook for K3s cluster setup
2025-04-07 21:26:06 +08:00
shenlan
d21d302639
Merge pull request #56 from svc-design/vpn-overlay
...
feat: split and simplify systemd-resolved DNS configuration task
2025-04-07 21:14:38 +08:00
Haitao Pan
d8ff3a79e2
feat: split and simplify systemd-resolved DNS configuration task
...
- Disabled systemd-resolved and add static DNS setup
2025-04-07 21:13:10 +08:00
shenlan
f4d92b0508
Merge pull request #54 from svc-design/vpn-overlay
...
chore(config): update firewall and VPN overlay settings
2025-04-07 20:11:40 +08:00
Haitao Pan
72e99501a1
chore(config): update firewall and VPN overlay settings
...
- allow UDP 51820 for WireGuard
- remove 10.253.0.0/16 from allowed IPs in WireGuard site configs
2025-04-07 20:10:49 +08:00
shenlan
1ca81f7ae7
Merge pull request #53 from svc-design/vpn-overlay
...
Vpn overlay
2025-04-07 15:41:37 +08:00
shenlan
d3c0ca69ec
Merge branch 'main' into vpn-overlay
2025-04-07 15:41:26 +08:00
Haitao Pan
954c3b26d9
chore(pulumi): add Pulumi.yaml for Modern Container App IaaS deployment
2025-04-07 15:40:02 +08:00
Haitao Pan
4d349ca572
feat(config): update master-1,slave-1 VPN Overlay IP
2025-04-07 15:31:53 +08:00
shenlan
7c54c045d4
Merge pull request #52 from svc-design/vpn-overlay
...
feat(config): add WireGuard key pair config for deepflow-demo mainten…
2025-04-07 13:35:19 +08:00
Haitao Pan
fcef8d55fd
feat(config): add WireGuard key pair config for deepflow-demo maintenance
2025-04-07 13:33:45 +08:00
Haitao Pan
4afb39ccfb
Update slave-1 br_ip: changed from 172.16.0.2 to 172.16.0.3
2025-04-06 19:42:41 +08:00
shenlan
aea056f04b
Merge pull request #51 from svc-design/vpn-overlay
...
Vpn overlay
2025-04-06 17:58:25 +08:00
Haitao Pan
5be8955ff5
feat: enhance WireGuard VPN Overlay deployment and DNAT support
...
Changes:
- Fixed wg0.conf.j2 template variables
- Refactored wireguard/site logic to support dynamic peer/key selection
- Updated defaults, playbook entry, and install script for consistency
Tested:
✅ NodePort 443 + DNAT verified from master/slave nodes and external curl
2025-04-06 17:50:32 +08:00
Haitao Pan
31c915eb1f
feat(config): add ignore_files support to config loader
2025-04-06 13:36:28 +08:00
Haitao Pan
bd8553f20e
feat(vpn-overlay): add WireGuard Site role
2025-04-06 13:29:01 +08:00
Haitao Pan
bfc960e4e9
feat(vxlan): support optional DNAT port mapping via EXPOSE_PORT
2025-04-06 12:28:58 +08:00
Haitao Pan
d38c4770ac
feat: Add VXLAN over WireGuard support with site automation
...
- Enabled VXLAN over L3 via WireGuard tunnel;
- Standardized Ansible role structure for `vpn-overlay`;
- Integrated systemd service management via `vxlan-setup.service`;
- Configured per-site VXLAN overlay in `config/sit/vpn-overlay.yaml`;
2025-04-06 00:08:17 +08:00
shenlan
af211196f7
Merge pull request #50 from svc-design/vpn-overlay
...
feat(ansible): improve Linux OS setup role (vhosts/common)
2025-04-05 17:51:35 +08:00
Haitao Pan
cb8dda4fed
feat(ansible): improve Linux OS setup role (vhosts/common)
2025-04-05 17:50:43 +08:00
shenlan
20d1491f0f
Merge pull request #49 from svc-design/vpn-overlay
...
feat(ansible): add Linux OS setup role (vhosts/common)
2025-04-05 17:48:16 +08:00
Haitao Pan
d7871dc331
feat(ansible): add Linux OS setup role (vhosts/common)
2025-04-05 17:46:23 +08:00
Haitao Pan
7a1b15416f
add scripts/auto-fix-gitleaks.sh
2025-04-05 13:57:43 +08:00
shenlan
39bc469246
Merge pull request #48 from svc-design/iac_modules_pulumi-scripts
...
feat(ansible): add dynamic inventory and ansible.cfg
2025-04-05 12:43:21 +08:00
Haitao Pan
98a115b96f
feat(ansible): add dynamic inventory and ansible.cfg
...
- Add ansible.cfg for plugin config
- Enabled Pulumi passphrase auto-load in run.sh
- Add scripts/dynamic_inventory.py with --list, --host, --export-static
- Cleanup: remove legacy inventory.py
2025-04-05 12:38:31 +08:00
shenlan
9d7d6160bc
Merge pull request #47 from svc-design/vpn-overlay
...
Vpn overlay
2025-04-05 11:59:21 +08:00
Haitao Pan
ff5741f8df
feat(vxlan): enhance setup_sit_vxlan.sh, add overlay_diag.sh and README
...
- Changed parameter order: <dev_if> <local_ip> <remote_ip> <br0_ip> [cidr_suffix] [vxlan_id]
- Automatically apply CIDR suffix (/16 by default)
- Auto-trigger ARP learning with ping from veth
- Fixed SNAT to use dynamic interface instead of hardcoded eth0
- Added overlay_diag.sh to verify interface, FDB, VXLAN traffic and NAT status
- Added README.md with usage instructions and examples
2025-04-05 11:46:19 +08:00
Haitao Pan
1f40718d3f
Merge branch 'main' into vpn-overlay
2025-04-05 10:57:46 +08:00
shenlan
b3028191a2
Merge pull request #46 from svc-design/iac_modules_pulumi_ec2_utils
...
feat: refine firewall rules and improve AMI resolution
2025-04-04 21:38:37 +08:00
Haitao Pan
a06d872a75
feat: refine firewall rules and improve AMI resolution
...
- Renamed and split firewall rules by VPC
- Refactored resolve_ami() to reduce duplication and improve extensibility
2025-04-04 21:35:06 +08:00
shenlan
4e6c370d34
Merge pull request #45 from svc-design/iac_modules_pulumi_sg_rules
...
feat(iac): support multi-VPC & multi-SG binding for EC2 instances
2025-04-03 23:05:51 +08:00
Haitao Pan
9bcefe35a2
feat(iac): support multi-VPC & multi-SG binding for EC2 instances
2025-04-03 23:01:09 +08:00
Haitao Pan
f4a426c4c3
Merge branch 'main' into vpn-overlay
2025-04-03 21:34:23 +08:00
Haitao Pan
dbcb47cc07
git commit -m "feat(vxlan): implement safe vxlan + bridge overlay without eth0 bridging"
2025-04-03 21:33:42 +08:00
Haitao Pan
3263f37724
add vpn-overlay/vxlan/setup_sit_vxlan.sh
2025-04-03 21:16:43 +08:00
shenlan
d4d252a995
Merge pull request #44 from svc-design/iac_modules_pulumi_multi_vpc
...
feat(vpc): auto-create and associate route tables based on subnet type
2025-04-03 21:10:08 +08:00
Haitao Pan
c5a776dca2
feat(vpc): auto-create and associate route tables based on subnet type
2025-04-03 21:07:51 +08:00
shenlan
8d68b33420
Merge pull request #43 from svc-design/iac_modules_pulumi_multi_vpc
...
feat(vpc): support multiple VPC definitions in config and Pulumi module
2025-04-03 18:07:16 +08:00
shenlan
10b6205769
Update README.md
2025-04-03 15:24:32 +08:00
Haitao Pan
fd68db5812
feat(vpc): support multiple VPC definitions in config and Pulumi module
2025-04-03 14:42:17 +08:00
Haitao Pan
23cf4c1201
update vpn-overlay/README.md
2025-04-02 21:43:04 +08:00
