beatzaplenty/nixos
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(ha): promote HA file server to production flake targets

Browse Source 
Adds proxmox-ha-server-1 and proxmox-ha-server-2 as real mkTarget entries
alongside the existing proxmox-server, backed by a new ha-server build type.

New modules
  modules/ha/cluster-config.nix — DRBD resource + corosync nodelist sourced
    from vars (haServer1Host/Ip, haServer2Host/Ip); resource-only fencing for
    production STONITH; HA port firewall rules for DRBD, iSCSI, Corosync, pcsd
  modules/build-types/ha-server.nix — imports pacemaker-stack + iscsi-target
    + cluster-config + beszel; NFS exports from vars.haStorageRoot (XFS-over-DRBD
    mount); nfs-server.service.wantedBy force-cleared so Pacemaker controls
    start/stop on the Active node only

New hosts
  hosts/ha-server-{1,2}/host.nix — static IP from vars, unique hostId; sops
    secrets (beszel, corosync authkey) are TODOs pending sync-host-keys.sh

variables.nix
  haServer1/2Host, haServer1/2Ip, haServerVip, haStorageRoot, haIscsiIqn
  ports.haServerDrbd/Iscsi/Corosync{1,2,Crypto}/PacemakerRemoted/Pcsd

scripts/ha/ (migrated + updated from test-lab/ha/)
  cluster-init.sh — generates corosync authkey, initialises DRBD/XFS/iSCSI,
    creates NFS dataset dirs, configures Pacemaker with DRBD + XFS + iSCSI
    + nfs-server + VIP; STONITH disabled initially (enable separately)
  cluster-enable-stonith.sh — enables fence_pve_ssh STONITH after key deploy
  fence-pve-ssh.py — Proxmox SSH fence agent (node names updated to ha-server-1/2)
  acceptance-tests.sh — T1–T7 production acceptance tests

test-lab/ha/ removed — all Nix config moved to modules/ha/ and
  modules/build-types/; scripts moved to scripts/ha/

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HaH1cSGvhogRP5ExoF6nD8
This commit is contained in:
beatzaplenty
2026-07-27 11:26:37 +10:00
co-authored by Claude Sonnet 4.6
parent 724d9a45af
commit e3498b1087
17 changed files with 762 additions and 763 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/ha-server-2/host.nix
+24
View File
@@ -0,0 +1,24 @@
{ vars, ... }:
{
networking = {
hostName = vars.haServer2Host;
hostId = "7e8f9a0b";
useDHCP = false;
interfaces.ens18.ipv4.addresses = [{
address = vars.haServer2Ip;
prefixLength = 24;
}];
defaultGateway = "192.168.2.1";
nameservers = [ "192.168.2.1" "8.8.8.8" ];
};
# TODO: after running `bash scripts/secrets/sync-host-keys.sh proxmox-ha-server-2`
# add beszel agent pairing and sops-managed corosync authkey:
# imports = [ (import ../../modules/beszel/host-token.nix {
# name = "ha-server-2";
# sopsFile = ../../secrets/ha-server-2.yaml;
# }) ];
# services.beszel.agent.environment.KEY = "...";
system.stateVersion = "26.05";
}