From 87acbeddfb5d33631d0e44b370f0d959de72f859 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Thu, 13 Aug 2026 19:35:29 -0700 Subject: [PATCH 1/2] SYS-699 add lightweight msmtp agent; add BIND_IP option for garage --- ansible/roles/network/defaults/main.yml | 12 ++++++++++++ ansible/roles/network/tasks/main.yml | 3 +++ ansible/roles/network/tasks/msmtp.yml | 19 +++++++++++++++++++ images/data-sync/helm/values.yaml | 8 +------- k8s/helm/grafana/values.yaml | 4 ++-- services/garage/docker-compose.yml | 10 +++++----- 6 files changed, 42 insertions(+), 14 deletions(-) create mode 100644 ansible/roles/network/tasks/msmtp.yml diff --git a/ansible/roles/network/defaults/main.yml b/ansible/roles/network/defaults/main.yml index 934b36c8..b6b3fdb3 100644 --- a/ansible/roles/network/defaults/main.yml +++ b/ansible/roles/network/defaults/main.yml @@ -33,6 +33,18 @@ network: "{{ network_defaults | combine(network_override, recursive=True) }}" network_sysctl: net.ipv4.ip_nonlocal_bind: 1 +msmtp_defaults: + enabled: false + config: + defaults: "" + syslog: LOG_MAIL + account: default + host: smtp + port: 587 + from: root +msmtp_override: {} +msmtp: "{{ msmtp_defaults | combine(msmtp_override, recursive=True) }}" + sshd_opts_defaults: ciphers: - aes128-cbc diff --git a/ansible/roles/network/tasks/main.yml b/ansible/roles/network/tasks/main.yml index 56140629..b0355e8a 100644 --- a/ansible/roles/network/tasks/main.yml +++ b/ansible/roles/network/tasks/main.yml @@ -14,3 +14,6 @@ - import_tasks: kernel.yml - import_tasks: sshd.yml + +- import_tasks: msmtp.yml + when: msmtp.enabled diff --git a/ansible/roles/network/tasks/msmtp.yml b/ansible/roles/network/tasks/msmtp.yml new file mode 100644 index 00000000..44a05902 --- /dev/null +++ b/ansible/roles/network/tasks/msmtp.yml @@ -0,0 +1,19 @@ +--- +- name: Install msmtp-mta + ansible.builtin.apt: + name: msmtp-mta + state: present + +- name: Configure msmtp + ansible.builtin.copy: + dest: /etc/msmtprc + content: | + # Managed by ansible + {% for key, val in msmtp.config.items() %} + {{ key }} {{ val }} + {% endfor %} + +- name: Remove postfix + ansible.builtin.apt: + name: postfix + state: absent diff --git a/images/data-sync/helm/values.yaml b/images/data-sync/helm/values.yaml index ff6314d7..df931ecd 100644 --- a/images/data-sync/helm/values.yaml +++ b/images/data-sync/helm/values.yaml @@ -105,19 +105,15 @@ configmap: ignore = Name ldapi ignore = Name lost+found ignore = Name msg.sock - # jenkins - ignore = Name *KubernetesClients.log ignore = Name *socket ignore = Name .s.PGSQL.5432 ignore = Name atlassian-*.log ignore = Name pgstat.stat - ignore = Path data-sync/share/artifactory/data/data/derby/log - ignore = Path data-sync/share/artifactory/data/logs/request.log + ignore = Path data-sync/share/headscale/db.sqlite-shm ignore = Path data-sync/share/nagios/var/rw ignore = Path data-sync/share/openldap/data/lock.mdb ignore = Path data-sync/share/snappymail/data/_default_/cache ignore = Path data-sync/dos - ignore = Path data-sync/headscale/db.sqlite-shm ignore = Path data-sync/home/*/.kube/cache ignore = Path data-sync/jira/home/analytics-logs ignore = Path data-sync/jira/home/log/automation-jira-performance.csv @@ -142,8 +138,6 @@ configmap: auto = true batch = true confirmbigdel = true - # copyquoterem feature seems to be gone as of 2.53.3 - ## copyquoterem = false # SYS-400 overall performance is absolutely awful without this fastercheckUNSAFE = true diff --git a/k8s/helm/grafana/values.yaml b/k8s/helm/grafana/values.yaml index 53591ee0..8363e28e 100644 --- a/k8s/helm/grafana/values.yaml +++ b/k8s/helm/grafana/values.yaml @@ -37,10 +37,10 @@ deployment: failureThreshold: 10 resources: limits: - memory: 256Mi + memory: 1024Mi requests: cpu: 100m - memory: 64Mi + memory: 128Mi volumeMounts: - mountPath: /var/lib/grafana name: data diff --git a/services/garage/docker-compose.yml b/services/garage/docker-compose.yml index 81c1da7f..4f730a6e 100644 --- a/services/garage/docker-compose.yml +++ b/services/garage/docker-compose.yml @@ -33,7 +33,7 @@ services: volumes: - webui-data:/data # required: user accounts, audit logs, upload temp files ports: - - 3909:3909 + - ${GARAGE_BIND_IP:-[::]}:3909:3909 environment: API_BASE_URL: "http://${GARAGE_HOST:-localhost}:3903" S3_ENDPOINT_URL: "http://${GARAGE_HOST:-}:3900" @@ -57,20 +57,20 @@ configs: consistency_mode = "consistent" replication_factor = 1 - rpc_bind_addr = "[::]:3901" + rpc_bind_addr = "${GARAGE_BIND_IP:-[::]}:3901" rpc_public_addr = "127.0.0.1:3901" compression_level = 2 [s3_api] s3_region = "${GARAGE_REGION:-garage}" - api_bind_addr = "[::]:3900" + api_bind_addr = "${GARAGE_BIND_IP:-[::]}:3900" root_domain = "api.${GARAGE_DOMAIN:-s3.garage.localhost}" [s3_web] - bind_addr = "[::]:3902" + bind_addr = "${GARAGE_BIND_IP:-[::]}:3902" root_domain = "web.${GARAGE_DOMAIN:-s3.garage.localhost}" index = "index.html" [admin] - api_bind_addr = "0.0.0.0:3903" + api_bind_addr = "${GARAGE_BIND_IP:-[::]}:3903" admin_token = "${GARAGE_ADMIN_TOKEN:-****}" From e18a4902c8352e05af21e561856898bab1103862 Mon Sep 17 00:00:00 2001 From: Rich Braun Date: Thu, 13 Aug 2026 23:42:30 -0700 Subject: [PATCH 2/2] SYS-699 wip --- k8s/Makefile | 2 +- k8s/Makefile.vars | 4 +++- k8s/helm/headscale/values.yaml | 19 ++++++++++++------- k8s/install/rsyslog-ext.yaml | 14 ++++++++++++++ 4 files changed, 30 insertions(+), 9 deletions(-) create mode 100644 k8s/install/rsyslog-ext.yaml diff --git a/k8s/Makefile b/k8s/Makefile index 8d3152f8..596ea11c 100644 --- a/k8s/Makefile +++ b/k8s/Makefile @@ -96,7 +96,7 @@ install: install/admin-user cluster_network \ install_imports namespace_config install/prometheus-rbac \ install/k8s-backup fluent-bit remote_volumes \ sops data-sync-ssh persistent secrets install/ingress-nginx \ - install/cert-manager + install/rsyslog-ext install/cert-manager namespace_config: install/namespace install/limits install/namespace-user \ secrets/regcred diff --git a/k8s/Makefile.vars b/k8s/Makefile.vars index 2f7e3f6b..c572c6d5 100644 --- a/k8s/Makefile.vars +++ b/k8s/Makefile.vars @@ -38,9 +38,11 @@ export RSYSLOGD_IP ?= 10.101.1.40 export COREDNS_IP ?= 10.96.0.10 export NODE_LOCAL_DNS_IP ?= 169.254.0.10 -# Exposed nodePorts - install/ingress-nginx.yaml +# Exposed nodePorts - install/ingress-nginx.yaml, install/rsyslog-ext.yaml export NODEPORT_HTTP ?= 30080 export NODEPORT_HTTPS ?= 30443 +export NODEPORT_SYSLOG ?= 30514 + # Ports configured in ingress-nginx.yaml export PORT_DOVECOT_IMAPD ?= 843 export PORT_DOVECOT_IMAPS ?= 993 diff --git a/k8s/helm/headscale/values.yaml b/k8s/helm/headscale/values.yaml index 530a9126..e29048cc 100644 --- a/k8s/helm/headscale/values.yaml +++ b/k8s/helm/headscale/values.yaml @@ -19,6 +19,9 @@ deployment: containerPorts: - containerPort: 8080 - containerPort: 9090 + - containerPort: 3478 + protocol: UDP + name: stun resources: limits: memory: 512Mi @@ -52,6 +55,8 @@ service: clusterIP: None ports: - { port: 8080, targetPort: 8080, name: headscale } + - { port: 3478, targetPort: 3478, name: stun, protocol: UDP } + - { port: 41641, targetPort: 41461, name: wireguard, protocol: UDP } type: ClusterIP ingress: @@ -102,17 +107,17 @@ configmap: derp: server: enabled: false - region_id: 999 - region_code: "headscale" - region_name: "Headscale Embedded DERP" - stun_listen_addr: "0.0.0.0:3478" - private_key_path: /var/lib/headscale/derp_server_private.key - automatically_add_embedded_derp_region: true + region_id: 999 + region_code: "headscale" + region_name: "Headscale Embedded DERP" + stun_listen_addr: "0.0.0.0:3478" + private_key_path: /var/lib/headscale/derp_server_private.key + automatically_add_embedded_derp_region: true urls: - https://controlplane.tailscale.com/derpmap/default paths: [] auto_update_enabled: true - update_frequency: 3h + update_frequency: 24h disable_check_updates: false node: expire: 0 diff --git a/k8s/install/rsyslog-ext.yaml b/k8s/install/rsyslog-ext.yaml new file mode 100644 index 00000000..501c01eb --- /dev/null +++ b/k8s/install/rsyslog-ext.yaml @@ -0,0 +1,14 @@ +--- +# for remote VPN-connected systems +apiVersion: v1 +kind: Service +metadata: + name: rsyslogd-external + namespace: $K8S_NAMESPACE +spec: + type: NodePort + ports: + - { port: 514, nodePort: $NODEPORT_SYSLOG, targetPort: 514, name: rsyslogd } + selector: + app.kubernetes.io/name: rsyslogd + sessionAffinity: ClientIP