feat: migrate all managed LXC provisioning to OpenTofu (blue-green)
Blue-green: a new container is created beside the old one, data is copied, the
IP is moved onto it, and the old container is kept stopped as rollback for at
least a week. Keeping the IP means only the VMID changes, and its consumers
(backup jobs, backup audit) already derive it from the registry.
Batch 1 (2026-09-02): emergency-bot 148->151, docker-test 145->152,
gitea 141->153, vaultwarden 140->154, monitoring 146->155, gyro 150->156,
grimmory 149->157.
Batch 2 (2026-09-03): adguard 144->158, mihomo 143->159, ovpn-mini 132->160.
All migratable LXC are now provisioner: tofu. hermes-ai (frozen) and pbs stay.
- tofu/services.tf + tofu/svc-*.tf: one resource per service, reproducing the
pct-config etalon. /dev/fuse -> features.fuse; /dev/net/tun ->
device_passthrough (first live use on mihomo and ovpn-mini); gitea bind mount
-> datastore volume (data finally reaches PBS); console { type = "shell" }
declared explicitly (provider tracks cmode there).
- services.yml: vmid + provisioner: tofu for every migrated service; features
strings and device notes updated to the tofu representation; also drops the
memoir-bot entry and adds homelab_reverse_proxy_image/_unit.
- pve-*.yml: configuration play target is `{{ pve_config_target | default(...) }}`
so it can run against <name>-new on a temp address (a bare --limit zeroes the
play instead of retargeting it). Container-creation plays are gated behind
`provisioner != 'tofu'` / `pve_provisioning_enabled` (meta: end_play), so a
stray run cannot pct start a stopped OLD VMID on a live IP. Override for
intentional legacy rollback: -e pve_<svc>_legacy_provisioning_enabled=true.
- ssh_config: drop memoir-bot; ovpn-mini gets ProxyJump none (a jump via ru-vps
would route through the very tunnel ovpn-mini terminates).
- gyro.yml / uptime-kuma.yml: same pve_config_target override.
- roles/uptime_kuma: only freeze homelab-monitoring when the unit actually
exists (a fresh blue-green container never had it).
- offsite-restic-yadisk.yml: the gitea restic profile now runs inside the LXC
(hosts: gitea), since the bind-mount host path is gone after the volume move;
lost+found excluded (unreadable in an unprivileged LXC, restic exit 3).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V
This commit is contained in:
Dmitry
co-authored by
Claude Sonnet 5
Claude Sonnet 5
parent
e349f19e68
commit
a3fe8031fe
@@ -2,6 +2,10 @@
|
||||
- name: Guard Grimmory VMID before API updates
|
||||
hosts: cloud-pc
|
||||
gather_facts: false
|
||||
pre_tasks:
|
||||
- name: Skip legacy Grimmory provisioning for runtime-only calls
|
||||
ansible.builtin.meta: end_play
|
||||
when: not (pve_provisioning_enabled | default(true) | bool)
|
||||
tasks:
|
||||
- name: Read existing VMID 149 configuration
|
||||
ansible.builtin.command: pct config 149
|
||||
@@ -28,6 +32,10 @@
|
||||
connection: local
|
||||
become: false
|
||||
gather_facts: false
|
||||
pre_tasks:
|
||||
- name: Skip legacy Grimmory provisioning for runtime-only calls
|
||||
ansible.builtin.meta: end_play
|
||||
when: not (pve_provisioning_enabled | default(true) | bool)
|
||||
vars:
|
||||
ansible_become: false
|
||||
ansible_python_interpreter: "{{ ansible_playbook_python }}"
|
||||
@@ -52,6 +60,10 @@
|
||||
- name: Configure Grimmory LXC devices
|
||||
hosts: cloud-pc
|
||||
gather_facts: false
|
||||
pre_tasks:
|
||||
- name: Skip legacy Grimmory provisioning for runtime-only calls
|
||||
ansible.builtin.meta: end_play
|
||||
when: not (pve_provisioning_enabled | default(true) | bool)
|
||||
vars:
|
||||
grimmory_vmid: 149
|
||||
handlers:
|
||||
@@ -119,13 +131,32 @@
|
||||
ansible_become: false
|
||||
|
||||
- name: Configure Grimmory runtime
|
||||
hosts: grimmory
|
||||
# Таргет переопределяем ради blue-green переезда на OpenTofu: во время
|
||||
# миграции этот play нужно прогнать против нового контейнера на временном
|
||||
# адресе. Просто `--limit grimmory-new` для этого НЕ годится — лимит
|
||||
# пересекается с паттерном play и даёт ноль хостов, а не перенацеливание
|
||||
# (проверено 2026-09-02 через --list-hosts на всех плейбуках).
|
||||
# Использовать вместе с --limit, чтобы play создания контейнера отсеялся:
|
||||
# ansible-playbook playbooks/pve-grimmory.yml \
|
||||
# -e pve_config_target=grimmory-new --limit grimmory-new
|
||||
# По умолчанию поведение не меняется.
|
||||
hosts: "{{ pve_config_target | default('grimmory') }}"
|
||||
gather_facts: true
|
||||
vars:
|
||||
ansible_become: false
|
||||
grimmory_root: /opt/grimmory
|
||||
grimmory_image: grimmory/grimmory:v3.2.4@sha256:dfa7afdfcf25d649fd664497a62385dd00cd9678c37546e182c172e41c8e80cb
|
||||
grimmory_mariadb_image: lscr.io/linuxserver/mariadb:11.4.8@sha256:91de7f701bc7fc3a424b81beafca7a7c6c4c5b7c8be6afd2ae148698695c0b0c
|
||||
# Адрес, на который биндится порт, на который смотрят правила DOCKER-USER и
|
||||
# по которому проверяется health. Раньше во всех трёх местах был зашит
|
||||
# боевой 192.168.1.34, из-за чего play нельзя было прогнать против другого
|
||||
# контейнера: Docker не биндит чужой адрес и роняет grimmory.service, а
|
||||
# health-check уходил по сети в БОЕВОЙ сервис и давал ложный успех.
|
||||
# expected_lan_ip — уже принятая в репозитории идиома для "адрес этого
|
||||
# хоста в LAN" (её же использует roles/uptime_kuma). На боевом grimmory она
|
||||
# равна 192.168.1.34, поэтому рендер там не меняется. Найдено 2026-09-02
|
||||
# при blue-green переезде на OpenTofu.
|
||||
grimmory_bind_ip: "{{ expected_lan_ip }}"
|
||||
tasks:
|
||||
- name: Install Grimmory runtime packages
|
||||
ansible.builtin.apt:
|
||||
@@ -298,7 +329,7 @@
|
||||
mariadb:
|
||||
condition: service_healthy
|
||||
ports:
|
||||
- "192.168.1.34:6060:6060"
|
||||
- "{{ grimmory_bind_ip }}:6060:6060"
|
||||
volumes:
|
||||
- ./data:/app/data
|
||||
- ./books:/books
|
||||
@@ -338,9 +369,9 @@
|
||||
iptables -N GRIMMORY-FILTER 2>/dev/null || true
|
||||
iptables -F GRIMMORY-FILTER
|
||||
iptables -A GRIMMORY-FILTER -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
|
||||
iptables -A GRIMMORY-FILTER -s {{ homelab_lan_cidr }} -p tcp -m conntrack --ctorigdst 192.168.1.34 --ctorigdstport 6060 -j ACCEPT
|
||||
iptables -A GRIMMORY-FILTER -s {{ openvpn_network_cidr }} -p tcp -m conntrack --ctorigdst 192.168.1.34 --ctorigdstport 6060 -j ACCEPT
|
||||
iptables -A GRIMMORY-FILTER -p tcp -m conntrack --ctorigdst 192.168.1.34 --ctorigdstport 6060 -j DROP
|
||||
iptables -A GRIMMORY-FILTER -s {{ homelab_lan_cidr }} -p tcp -m conntrack --ctorigdst {{ grimmory_bind_ip }} --ctorigdstport 6060 -j ACCEPT
|
||||
iptables -A GRIMMORY-FILTER -s {{ openvpn_network_cidr }} -p tcp -m conntrack --ctorigdst {{ grimmory_bind_ip }} --ctorigdstport 6060 -j ACCEPT
|
||||
iptables -A GRIMMORY-FILTER -p tcp -m conntrack --ctorigdst {{ grimmory_bind_ip }} --ctorigdstport 6060 -j DROP
|
||||
iptables -A GRIMMORY-FILTER -j RETURN
|
||||
iptables -C DOCKER-USER -j GRIMMORY-FILTER 2>/dev/null || iptables -I DOCKER-USER 1 -j GRIMMORY-FILTER
|
||||
register: grimmory_firewall_script
|
||||
@@ -417,7 +448,7 @@
|
||||
|
||||
- name: Wait for Grimmory health endpoint
|
||||
ansible.builtin.uri:
|
||||
url: http://192.168.1.34:6060/api/v1/healthcheck
|
||||
url: http://{{ grimmory_bind_ip }}:6060/api/v1/healthcheck
|
||||
status_code: 200
|
||||
register: grimmory_health
|
||||
retries: 120
|
||||
|
||||
Reference in New Issue
Block a user