DmitryandClaude Sonnet 5
a3fe8031fe
Blue-green: a new container is created beside the old one, data is copied, the
IP is moved onto it, and the old container is kept stopped as rollback for at
least a week. Keeping the IP means only the VMID changes, and its consumers
(backup jobs, backup audit) already derive it from the registry.
Batch 1 (2026-09-02): emergency-bot 148->151, docker-test 145->152,
gitea 141->153, vaultwarden 140->154, monitoring 146->155, gyro 150->156,
grimmory 149->157.
Batch 2 (2026-09-03): adguard 144->158, mihomo 143->159, ovpn-mini 132->160.
All migratable LXC are now provisioner: tofu. hermes-ai (frozen) and pbs stay.
- tofu/services.tf + tofu/svc-*.tf: one resource per service, reproducing the
pct-config etalon. /dev/fuse -> features.fuse; /dev/net/tun ->
device_passthrough (first live use on mihomo and ovpn-mini); gitea bind mount
-> datastore volume (data finally reaches PBS); console { type = "shell" }
declared explicitly (provider tracks cmode there).
- services.yml: vmid + provisioner: tofu for every migrated service; features
strings and device notes updated to the tofu representation; also drops the
memoir-bot entry and adds homelab_reverse_proxy_image/_unit.
- pve-*.yml: configuration play target is `{{ pve_config_target | default(...) }}`
so it can run against <name>-new on a temp address (a bare --limit zeroes the
play instead of retargeting it). Container-creation plays are gated behind
`provisioner != 'tofu'` / `pve_provisioning_enabled` (meta: end_play), so a
stray run cannot pct start a stopped OLD VMID on a live IP. Override for
intentional legacy rollback: -e pve_<svc>_legacy_provisioning_enabled=true.
- ssh_config: drop memoir-bot; ovpn-mini gets ProxyJump none (a jump via ru-vps
would route through the very tunnel ovpn-mini terminates).
- gyro.yml / uptime-kuma.yml: same pve_config_target override.
- roles/uptime_kuma: only freeze homelab-monitoring when the unit actually
exists (a fresh blue-green container never had it).
- offsite-restic-yadisk.yml: the gitea restic profile now runs inside the LXC
(hosts: gitea), since the bind-mount host path is gone after the volume move;
lost+found excluded (unreadable in an unprivileged LXC, restic exit 3).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_012uoq5AVK8mkBgg83Mq6o5V
93 lines
3.0 KiB
Terraform
93 lines
3.0 KiB
Terraform
# ============================================================================
|
|
# Сервис №6: gyro (OLD vmid 150, mini-pc).
|
|
# Эталон снят 2026-09-02: ssh mini-pc sudo pct config 150.
|
|
#
|
|
# vm_id 156 — новый VMID для blue-green переезда, TMPIP 192.168.1.15.
|
|
# После шага 4.5.15 адрес — боевой 192.168.1.35, OLD (150) остановлен
|
|
# и остаётся откатом минимум неделю.
|
|
#
|
|
# ОСОБЕННОСТИ:
|
|
# - Контейнер намеренно без nesting (features: "" в эталоне).
|
|
# - Proxmox-фаервол уже перенесён на VMID 156; Datacenter firewall остаётся выключен.
|
|
# - Требует Ansible Vault password (make gyro для конфигурации).
|
|
# - Старое предупреждение про host key Gitea неверно: gyro пинит github.com,
|
|
# поэтому после cutover менять known_hosts не нужно.
|
|
# ============================================================================
|
|
|
|
resource "proxmox_virtual_environment_container" "gyro" {
|
|
node_name = "mini-pc"
|
|
vm_id = 156
|
|
unprivileged = true
|
|
start_on_boot = true
|
|
started = true
|
|
tags = ["tofu"]
|
|
|
|
initialization {
|
|
hostname = "gyro"
|
|
|
|
ip_config {
|
|
ipv4 {
|
|
address = "192.168.1.35/24"
|
|
gateway = "192.168.1.1"
|
|
}
|
|
}
|
|
|
|
dns {
|
|
servers = ["1.1.1.1"]
|
|
}
|
|
|
|
user_account {
|
|
keys = [trimspace(file(pathexpand("~/.ssh/id_ed25519_homelab.pub")))]
|
|
}
|
|
}
|
|
|
|
operating_system {
|
|
template_file_id = "local:vztmpl/debian-13-standard_13.1-2_amd64.tar.zst"
|
|
type = "debian"
|
|
}
|
|
|
|
cpu {
|
|
cores = 1
|
|
}
|
|
|
|
memory {
|
|
dedicated = 512
|
|
swap = 256
|
|
}
|
|
|
|
disk {
|
|
datastore_id = "local-lvm"
|
|
size = 2
|
|
}
|
|
|
|
# Эталон: features: (пусто) — nesting отключён НАМЕРЕННО, no keyctl, no fuse.
|
|
# Блок features не объявляется, чтобы провайдер не создавал его с дефолтами.
|
|
# Это консервативное решение: gyro этот функционал не требует.
|
|
|
|
# roles/pve_lxc всем контейнерам ставит cmode=shell (pve_lxc_cmode), провайдер
|
|
# это отслеживает через блок console.type — без него на следующем apply
|
|
# откатит на дефолт Proxmox tty. Обнаружено 2026-09-02 на emergency-bot.
|
|
console {
|
|
type = "shell"
|
|
}
|
|
|
|
network_interface {
|
|
name = "eth0"
|
|
bridge = "vmbr0"
|
|
firewall = true
|
|
}
|
|
|
|
startup {
|
|
order = 80
|
|
}
|
|
}
|
|
|
|
output "gyro" {
|
|
description = "Что проверять на узле после apply"
|
|
value = {
|
|
vmid = proxmox_virtual_environment_container.gyro.vm_id
|
|
node = proxmox_virtual_environment_container.gyro.node_name
|
|
verify = "ssh mini-pc sudo pct config ${proxmox_virtual_environment_container.gyro.vm_id}"
|
|
}
|
|
}
|