ada/infra
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: adopt the ru-vps Caddy stack, fix cluster quorum, decommission ZeroTier

Browse Source 
One ru-vps housekeeping sweep (2026-09-02/03):

- playbooks/ru-vps-base.yml (new): adopt the Caddy compose stack into Ansible
  (pinned image by digest, homelab-caddy.service), and manage the corosync-qnetd
  UFW rule - allow 5403/tcp from homelab_pve_egress_ip, drop the stale rule for
  the retired ZeroTier 10.122.62.0/24. The qdevice had gone silent because its
  only allowed path was the decommissioned ZeroTier network.
- group_vars/all/main.yml: homelab_pve_egress_ip (the NATed home egress the PVE
  nodes reach corosync-qnetd from - a direct path that does not depend on the
  OpenVPN tunnel). Marked dynamic: a change silently re-breaks the qdevice.
- playbooks/status.yml: CLUSTER QUORUM section (pvecm status per PVE node) so a
  repeat failure is visible. Also drops the memoir-bot unit list and moves the
  gitea offsite-restic unit to the gitea host (see the OpenTofu-migration commit).
- playbooks/ru-vps-zerotier-decommission.yml (new): stop the zerotier container,
  disable ssh-zt22.service, remove the interface/9993/9001/10.122.62.0/24 UFW
  rules. Node identity and data are kept; removal is a separate step.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V
This commit is contained in:
Dmitry
2026-09-03 07:05:11 +03:00
co-authored by Claude Sonnet 5
parent e24b75534e
commit 79878e36f9
4 changed files with 358 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ansible/inventory/group_vars/all/main.yml
+10
View File
@@ -13,6 +13,16 @@ ansible_become: true
homelab_lan_cidr: 192.168.1.0/24
homelab_service_range: 192.168.1.5-192.168.1.40
# Публичный адрес, с которого обе ноды PVE выходят в интернет (домашний NAT).
# Нужен для правила UFW на ru-vps, открывающего corosync-qnetd (5403/tcp):
# арбитр кластера обязан быть достижим по пути, не зависящему ни от одной ноды,
# поэтому ходим напрямую, а не через OpenVPN-туннель (он живёт в CT 160 на
# mini-pc — при падении mini-pc арбитр исчез бы вместе с ним).
# ВНИМАНИЕ: адрес динамический. Если он сменится, qdevice замолчит так же тихо,
# как это уже случилось после вывода ZeroTier. Признак — `pvecm status`:
# Total votes меньше Expected votes и флаг NV у узлов.
homelab_pve_egress_ip: 85.143.112.108
openvpn_network_cidr: 10.78.0.0/30
openvpn_listen_port: 8443
openvpn_forwarded_services: