beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor(ha): renumber cluster→VLAN10, storage→VLAN20; iSCSI/NFS protocol separation
Check NixOS configurations / eval-hosts (push) Failing after 17m31s
Details

Browse Source 
Renumber internal HA bridges so VLAN ID matches IP third octet:
  vmbr1 (cluster): 192.168.4.x → 192.168.10.x (VLAN 10, /29)
  vmbr2 (storage): 192.168.5.x → 192.168.20.x (VLAN 20, /24)

Enforce protocol separation at the firewall on both HA nodes:
  - iSCSI (3260/tcp): storage-client subnet (192.168.20.0/24) only
  - NFS (111,2049,20048 tcp+udp): LAN subnet (192.168.2.0/24) only
  - Cluster subnet (192.168.10.224/29) accepted wholesale (DRBD+Corosync)
Moves from allowedTCPPorts/allowedUDPPorts to source-restricted extraCommands
rules on the nixos-fw chain.

NFS exports reduced to LAN-only (drop haClientCidr lines from mkNfsExports).
Storage-client network clients use iSCSI only; no NFS on VLAN 20.

All HA script VIP/storage IP defaults updated to match.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01J8djTWdXVzXZc99iujU6T2
This commit is contained in:
beatzaplenty
2026-07-29 18:19:07 +10:00
co-authored by Claude Sonnet 4.6
parent 5eea38d3ca
commit bf4836efac
9 changed files with 73 additions and 63 deletions
Download Patch File Download Diff File Expand all files Collapse all files
variables.nix
+17 -15
View File
@@ -103,27 +103,29 @@
# HA file server cluster
# LAN IPs (vmbr0 / ens18) — management only after storage migration.
# Cluster IPs (vmbr1 / ens19) — isolated internal bridge, DRBD replication
# and Corosync heartbeat only; never leaves pve1.
# Storage-client IPs (vmbr2 / ens20) — isolated internal bridge for iSCSI
# and NFS; docker and server VMs connect here instead of crossing vmbr0.
# Cluster IPs (vmbr1 / ens19) — VLAN 10 (192.168.10.x), isolated internal bridge,
# DRBD replication and Corosync heartbeat only; never leaves pve1.
# Storage-client IPs (vmbr2 / ens20) — VLAN 20 (192.168.20.x), isolated internal
# bridge for iSCSI; docker and server VMs connect here instead of crossing vmbr0.
# haServerVip: floating virtual IP on vmbr2, managed by Pacemaker IPaddr2;
# all iSCSI and NFS clients connect here regardless of which node is Active.
# iSCSI clients connect here regardless of which node is Active.
# Protocol separation: iSCSI on storage-client subnet (VLAN 20) only;
# NFS on LAN subnet (VLAN 2) only. Enforced by firewall on the HA nodes.
haServer1Host = "ha-server-1";
haServer2Host = "ha-server-2";
haServer1Ip = "192.168.2.228"; # LAN IP, node 1 (vmbr0 / ens18)
haServer2Ip = "192.168.2.227"; # LAN IP, node 2 (vmbr0 / ens18)
haServer1StorageIp = "192.168.4.228"; # cluster-net IP, node 1 (vmbr1 / ens19)
haServer2StorageIp = "192.168.4.227"; # cluster-net IP, node 2 (vmbr1 / ens19)
haStorageCidr = "192.168.4.224/29"; # cluster subnet — internal to pve1 only
haServer1StorageIp = "192.168.10.228"; # cluster-net IP, node 1 (vmbr1 / ens19, VLAN 10)
haServer2StorageIp = "192.168.10.227"; # cluster-net IP, node 2 (vmbr1 / ens19, VLAN 10)
haStorageCidr = "192.168.10.224/29"; # cluster subnet — VLAN 10, internal to pve1 only
haStoragePrefixLength = 29; # cluster subnet prefix length (/29)
haServer1ClientIp = "192.168.5.228"; # storage-client IP, node 1 (vmbr2 / ens20)
haServer2ClientIp = "192.168.5.227"; # storage-client IP, node 2 (vmbr2 / ens20)
haServerVip = "192.168.5.229"; # storage-client floating VIP on vmbr2 (Pacemaker IPaddr2 vip-storage)
haServerLanVip = "192.168.2.229"; # LAN floating VIP on vmbr0 (Pacemaker IPaddr2 vip-lan) — LAN iSCSI/NFS access
dockerStorageIp = "192.168.5.225"; # docker CT storage-client IP (vmbr2 / eth1)
serverStorageIp = "192.168.5.226"; # server VM storage-client IP (vmbr2 / ens19)
haClientCidr = "192.168.5.0/24"; # storage-client subnet — internal to pve1 only
haServer1ClientIp = "192.168.20.228"; # storage-client IP, node 1 (vmbr2 / ens20, VLAN 20)
haServer2ClientIp = "192.168.20.227"; # storage-client IP, node 2 (vmbr2 / ens20, VLAN 20)
haServerVip = "192.168.20.229"; # storage-client floating VIP on vmbr2 (Pacemaker IPaddr2 vip-storage, VLAN 20)
haServerLanVip = "192.168.2.229"; # LAN floating VIP on vmbr0 (Pacemaker IPaddr2 vip-lan) — NFS access
dockerStorageIp = "192.168.20.225"; # docker CT storage-client IP (vmbr2 / eth1, VLAN 20)
serverStorageIp = "192.168.20.226"; # server VM storage-client IP (vmbr2 / ens19, VLAN 20) — temporary, for final rsync
haClientCidr = "192.168.20.0/24"; # storage-client subnet — VLAN 20, internal to pve1 only
haClientPrefixLength = 24; # storage-client subnet prefix length (/24)
haStorageRoot = "/srv/ha-data"; # XFS-over-DRBD mount point on the Active node
haIscsiIqn = "iqn.2026-01.home.sweet:ha-storage";