4 Commits

Include renames

Author	SHA1	Message	Date
beatzaplentyandClaude Sonnet 4.6	bf4836efac	refactor(ha): renumber cluster→VLAN10, storage→VLAN20; iSCSI/NFS protocol separation ... Renumber internal HA bridges so VLAN ID matches IP third octet: vmbr1 (cluster): 192.168.4.x → 192.168.10.x (VLAN 10, /29) vmbr2 (storage): 192.168.5.x → 192.168.20.x (VLAN 20, /24) Enforce protocol separation at the firewall on both HA nodes: - iSCSI (3260/tcp): storage-client subnet (192.168.20.0/24) only - NFS (111,2049,20048 tcp+udp): LAN subnet (192.168.2.0/24) only - Cluster subnet (192.168.10.224/29) accepted wholesale (DRBD+Corosync) Moves from allowedTCPPorts/allowedUDPPorts to source-restricted extraCommands rules on the nixos-fw chain. NFS exports reduced to LAN-only (drop haClientCidr lines from mkNfsExports). Storage-client network clients use iSCSI only; no NFS on VLAN 20. All HA script VIP/storage IP defaults updated to match. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J8djTWdXVzXZc99iujU6T2	2026-07-29 18:19:07 +10:00
beatzaplentyandClaude Sonnet 4.6	8d43b7039c	feat(ha): add vmbr2 storage-client network and corosync ring1 ... Infrastructure changes already applied to pve1: - vmbr2 internal bridge created (192.168.5.0/24, no physical uplink) - VM 200 (ha-server-1): net2 added → vmbr2 (ens20) - VM 201 (ha-server-2): net2 added → vmbr2 (ens20) - CT 105 (docker): net1 added → vmbr2 (eth1) - VM 101 (server): net1 added → vmbr2 (ens19) — needs reboot to activate NixOS config (deploy to ha nodes to complete; docker/server at cutover): - ha-server-{1,2}/host.nix: ens20 with 192.168.5.{228,227}/24 - docker/host.nix: eth1 with 192.168.5.225/24 - server/host.nix: ens19 with 192.168.5.226/24 - cluster-config.nix: corosync ring1 on LAN IPs as backup heartbeat path - cluster-config.nix: allow haClientCidr (192.168.5.0/24) in iptables - ha-server.nix: NFS exports now allow both lanCidr and haClientCidr - VIP moves from 192.168.2.229 (vmbr0/LAN) to 192.168.5.229 (vmbr2) - iSCSI portal to be rebound from [::0] to 192.168.5.229 at cutover variables.nix: haStorageCidr corrected to 192.168.4.224/29; new vars: vmStorageClientInterface, lxcStorageInterface, haServer{1,2}ClientIp, dockerStorageIp, serverStorageIp, haClientCidr/PrefixLength; haServerVip updated to 192.168.5.229. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-29 16:02:53 +10:00
beatzaplentyandClaude Sonnet 4.6	71a6c4738c	fix(ha): fix crm_mon active-node detection in all three scripts ... crm_mon 2.x formats the Promoted line as " * Promoted: [ node ]" — the asterisk bullet means the previous grep -E '^\s*(Promoted|Masters):' never matched, so active-node detection silently returned empty in health.sh, failover.sh, and acceptance-tests.sh. Fix: pipe through grep -v Unpromoted first, then grep -E '(Promoted|Masters):' without anchoring to start-of-line. Also: remove the SSH_OPTS=-i ~/.ssh/... variable pattern in health.sh and failover.sh; tilde is not expanded inside double-quoted strings, so $SSH_OPTS was passing a literal ~ to SSH. Inline the key path in each function definition instead (same as acceptance-tests.sh already did). Also: drop the 2>/dev/null embedded in the crm_mon argument string — the outer 2>/dev/null on the n1/n2 call already suppresses SSH stderr; the embedded one was harmless but noisy to reason about. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-29 02:36:22 +10:00
beatzaplentyandClaude Sonnet 4.6	793a2b5924	feat(ha): add failover.sh and health.sh operator scripts ... failover.sh: graceful active→standby resource migration with pre-checks (DRBD UpToDate/UpToDate, quorum), spinner wait for XFS mount on target, rollback on timeout, --to/--force/--dry-run/--timeout flags. health.sh: read-only status panel — node reachability, quorum, DRBD role/dstate/cs per node, Pacemaker resources, failure history, XFS mount usage, and service port checks (NFS 2049, iSCSI 3260) via VIP. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-29 02:23:47 +10:00