DmitryandClaude Sonnet 5
a3fe8031fe
Blue-green: a new container is created beside the old one, data is copied, the
IP is moved onto it, and the old container is kept stopped as rollback for at
least a week. Keeping the IP means only the VMID changes, and its consumers
(backup jobs, backup audit) already derive it from the registry.
Batch 1 (2026-09-02): emergency-bot 148->151, docker-test 145->152,
gitea 141->153, vaultwarden 140->154, monitoring 146->155, gyro 150->156,
grimmory 149->157.
Batch 2 (2026-09-03): adguard 144->158, mihomo 143->159, ovpn-mini 132->160.
All migratable LXC are now provisioner: tofu. hermes-ai (frozen) and pbs stay.
- tofu/services.tf + tofu/svc-*.tf: one resource per service, reproducing the
pct-config etalon. /dev/fuse -> features.fuse; /dev/net/tun ->
device_passthrough (first live use on mihomo and ovpn-mini); gitea bind mount
-> datastore volume (data finally reaches PBS); console { type = "shell" }
declared explicitly (provider tracks cmode there).
- services.yml: vmid + provisioner: tofu for every migrated service; features
strings and device notes updated to the tofu representation; also drops the
memoir-bot entry and adds homelab_reverse_proxy_image/_unit.
- pve-*.yml: configuration play target is `{{ pve_config_target | default(...) }}`
so it can run against <name>-new on a temp address (a bare --limit zeroes the
play instead of retargeting it). Container-creation plays are gated behind
`provisioner != 'tofu'` / `pve_provisioning_enabled` (meta: end_play), so a
stray run cannot pct start a stopped OLD VMID on a live IP. Override for
intentional legacy rollback: -e pve_<svc>_legacy_provisioning_enabled=true.
- ssh_config: drop memoir-bot; ovpn-mini gets ProxyJump none (a jump via ru-vps
would route through the very tunnel ovpn-mini terminates).
- gyro.yml / uptime-kuma.yml: same pve_config_target override.
- roles/uptime_kuma: only freeze homelab-monitoring when the unit actually
exists (a fresh blue-green container never had it).
- offsite-restic-yadisk.yml: the gitea restic profile now runs inside the LXC
(hosts: gitea), since the bind-mount host path is gone after the volume move;
lost+found excluded (unreadable in an unprivileged LXC, restic exit 3).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V
62 lines
2.5 KiB
YAML
62 lines
2.5 KiB
YAML
---
|
|
# После переезда на OpenTofu (tofu/svc-ovpn-mini.tf, VMID 160) обе play здесь —
|
|
# legacy: они таргетят СТАРЫЙ VMID 132, а их handlers сделали бы pct start 132,
|
|
# подняв остановленный откат на боевом адресе 192.168.1.23. Пропускаем, пока
|
|
# реестр говорит provisioner: tofu. Конфигурация OpenVPN-шлюза в этот плейбук
|
|
# никогда не входила — она в playbooks/openvpn-vps-mini.yml (роль
|
|
# openvpn_gateway, группа vpn_openvpn). Для намеренного legacy rollback:
|
|
# -e pve_ovpn_mini_legacy_provisioning_enabled=true
|
|
|
|
- name: Create ovpn-mini LXC on mini-pc
|
|
hosts: localhost
|
|
connection: local
|
|
gather_facts: false
|
|
vars:
|
|
pve_ovpn_mini_legacy_provisioning_enabled: >-
|
|
{{ homelab_services['ovpn-mini'].provisioner != 'tofu' }}
|
|
pre_tasks:
|
|
- name: Skip legacy ovpn-mini provisioning after cutover
|
|
ansible.builtin.meta: end_play
|
|
when: not (pve_ovpn_mini_legacy_provisioning_enabled | bool)
|
|
roles:
|
|
- role: pve_lxc
|
|
vars:
|
|
pve_lxc_vmid: 132
|
|
pve_lxc_node: mini-pc
|
|
pve_lxc_hostname: ovpn-mini
|
|
pve_lxc_ip: 192.168.1.23/24
|
|
pve_lxc_gateway: 192.168.1.1
|
|
pve_lxc_storage: local-lvm
|
|
pve_lxc_disk: local-lvm:8
|
|
pve_lxc_ostemplate: "{{ lookup('env', 'PVE_LXC_OSTEMPLATE') | default('local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst', true) }}"
|
|
|
|
- name: Allow TUN device in ovpn-mini LXC config
|
|
hosts: mini-pc
|
|
gather_facts: false
|
|
become: true
|
|
vars:
|
|
pve_ovpn_mini_legacy_provisioning_enabled: >-
|
|
{{ homelab_services['ovpn-mini'].provisioner != 'tofu' }}
|
|
handlers:
|
|
- name: restart ovpn-mini lxc
|
|
ansible.builtin.shell: pct stop 132 || true; pct start 132
|
|
changed_when: true
|
|
pre_tasks:
|
|
- name: Skip legacy ovpn-mini provisioning after cutover
|
|
ansible.builtin.meta: end_play
|
|
when: not (pve_ovpn_mini_legacy_provisioning_enabled | bool)
|
|
tasks:
|
|
- name: Allow /dev/net/tun device
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/pve/lxc/132.conf
|
|
line: "lxc.cgroup2.devices.allow: c 10:200 rwm"
|
|
state: present
|
|
notify: restart ovpn-mini lxc
|
|
|
|
- name: Bind mount /dev/net/tun
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/pve/lxc/132.conf
|
|
line: "lxc.mount.entry: /dev/net/tun dev/net/tun none bind,create=file"
|
|
state: present
|
|
notify: restart ovpn-mini lxc
|