remote-blackbox: Scrape Invoice Ninja

With the transition to modular _libvirt_ daemons, the SELinux policy is
a bit more granular.  Unfortunately, the new policy has a funny [bug]: it
assumes directories named `storage` under `/run/libvirt` must be for
_virtstoraged_ and labels them as such, which prevents _virtnetworkd_
from managing a virtual network named `storage`.

To work around this, we need to give `/run/libvirt/network` a special
label so that its children do not match the file transition pattern for
_virtstoraged_ and thus keep their `virtnetworkd_var_run_t` label.

[bug]: https://bugzilla.redhat.com/show_bug.cgi?id=2362040

group_vars/raspberry-pi.yml

@@ -0,0 +1,2 @@
+collectd_plugins:
+  thermal: true

group_vars/remote-blackbox.yml

@@ -42,6 +42,7 @@ vmagent_scrape_configs:
     - https://tabitha.biz/
     - https://dustinandtabitha.com/
     - https://hatchlearningcenter.org/
+    - https://invoiceninja.pyrocufflink.net/
   relabel_configs:
   - source_labels: [__address__]
     target_label: __param_target

group_vars/vm-hosts.yml

@@ -246,26 +246,27 @@ vm_autostart:
 - dc-headphone
 - delay 30s
 - loki1
+- logs-dusk
 - delay 10s
 - db0
-- k8s-ctrl0
+- ctrl-crave
+- ctrl-sycamore
 - delay 10s
 - stor-alfalfa
 - stor-rentable
 - node-abreast
+- node-direction
 - node-gleaming
 - node-hatbox
-- node-refrain
 - delay 15s
 - web0
 - file0
 - cloud0
-- bw0
 - delay 5s
 - smtp1
 - delay 10s
 - pxe0
-- unifi3
+- unifi-nuptials
 
 promtail_dac_read_search: true
 promtail_scrape_configs:

hosts

@@ -97,7 +97,6 @@ file0.pyrocufflink.blue
 burp-server
 
 [k8s-controller]
-k8s-ctrl0.pyrocufflink.blue
 ctrl-2ed8d3.k8s.pyrocufflink.black
 
 [k8s-iot-net-ctrl]
@@ -185,7 +184,6 @@ dc-headphone.pyrocufflink.blue
 file0.pyrocufflink.blue
 git0.pyrocufflink.blue
 haproxy0.pyrocufflink.blue
-k8s-ctrl0.pyrocufflink.blue
 loki1.pyrocufflink.blue
 nut1.pyrocufflink.blue
 nvr2.pyrocufflink.blue
@@ -199,9 +197,13 @@ web0.pyrocufflink.blue
 samba-dc
 
 [raspberry-pi]
+ctrl-2ed8d3.k8s.pyrocufflink.black
 node-474c83.k8s.pyrocufflink.black
 nut1.pyrocufflink.blue
 
+[raspberry-pi:children]
+cm4-k8s-node
+
 [remote-blackbox]
 vps-04485add.vps.ovh.us
 

newvm.sh

@@ -138,6 +138,11 @@ if [ -z "${LIBVIRT_DEFAULT_URI}" ]; then
     exit 1
 fi
 
+if [ ${fedora} -gt 40 ] && [ ${memory} -lt 4096 ]; then
+    printf 'WARNING Fedora 41+ requires at least 4 GB memory to install\n' >&2
+    memory=4096
+fi
+
 if ${default_groups}; then
     groups_xml="<group name=\"chrony\"/>${groups_xml}"
     groups_xml="<group name=\"collectd\"/>${groups_xml}"
@@ -177,7 +182,7 @@ set -- \
     --extra-args "${extra_args}" \
     --disk pool=default,size=${disk_size},cache=none \
     --network ${network} \
-    --os-variant fedora$(rpm -E %fedora) \
+    --os-variant fedora-rawhide \
     --console pty,target.type=serial,log.file=/var/log/libvirt/console/${name}.log \
     --sound none \
     --redirdev none \

roles/vmhost/files/fix-run-libvirt-network.conf

@@ -0,0 +1,3 @@
+[Service]
+ExecStartPre=+/bin/mkdir -p %t/libvirt/network
+ExecStartPre=+/bin/chcon -t virtnetworkd_var_run_t %t/libvirt/network

roles/vmhost/files/vm-autostart.service

@@ -4,6 +4,8 @@ After=libvirt.service
 After=network-online.target
 Wants=network-online.target
 RequiresMountsFor=/var/lib/libvirt/images
+StartLimitInterval=1s
+StartLimitBurst=1
 
 [Service]
 Type=oneshot
@@ -11,9 +13,8 @@ RemainAfterExit=yes
 Environment=LIBVIRT_DEFAULT_URI=qemu:///system
 ExecStart=/usr/local/libexec/vm-autostart.sh
 Restart=on-failure
+RestartSec=1
 
-DynamicUser=yes
-SupplementaryGroups=libvirt
 CapabilityBoundingSet=
 DeviceAllow=
 DevicePolicy=closed

roles/vmhost/files/vm-autostart.sh

@@ -5,6 +5,8 @@ if [ ! -r /etc/vm-autostart ]; then
     exit 0
 fi
 
+virsh connect || exit
+
 while read name args; do
     if [ "${name}" = delay ]; then
         sleep ${args}

roles/vmhost/tasks/main.yml

@@ -40,6 +40,31 @@
   tags:
   - log-dir
 
+- name: ensure virtnetworkd.service drop-in directory exists
+  file:
+    path: /etc/systemd/system/virtnetworkd.service.d
+    owner: root
+    group: root
+    mode: u=rwx,go=rx
+    state: directory
+  tags:
+  - systemd
+  - virtnetworkd-selinux-bug
+  - 'rhbz#2362040'
+- name: 'ensure virtnetworkd selinux bug work-around is in place (rhbz#2362040)'
+  copy:
+    src: fix-run-libvirt-network.conf
+    dest: /etc/systemd/system/virtnetworkd.service.d/
+    owner: root
+    group: root
+    mode: u=rw,go=r
+  notify:
+  - reload systemd
+  tags:
+  - systemd
+  - virtnetworkd-selinux-bug
+  - 'rhbz#2362040'
+
 - name: ensure libvirtd starts at boot
   service:
     name: '{{ item }}'