Archived
beatzaplentyandClaude Sonnet 4.6
750121e9dd
Disposable test VMs (ha-test-node1 / ha-test-node2, VMIDs 200/201 on pve1) to evaluate whether the DRBD + XFS + LIO + Corosync + Pacemaker stack runs correctly on NixOS before deciding NixOS vs Debian for production. Includes: - test-lab/ha/disko.nix: 20G boot disk layout (smaller than production) - test-lab/ha/common.nix: shared HA stack (drbd, corosync, pacemaker, targetcli-fb, xfsprogs), OCF PATH workaround for nixpkgs#207891 - test-lab/ha/node1.nix / node2.nix: per-node hostname + static IP - test-lab/ha/fence-pve-ssh.py: Proxmox SSH fence agent for STONITH - test-lab/ha/cluster-init.sh: one-shot cluster bootstrap script - test-lab/ha/cluster-enable-stonith.sh: enables STONITH post-key-deploy - flake.nix: adds ha-test-node1 / ha-test-node2 nixosConfigurations (bypasses mkTarget / clan-core / sops-nix — test-only) These VMs must be destroyed once acceptance testing is complete. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
79 lines
3.5 KiB
Bash
79 lines
3.5 KiB
Bash
#!/usr/bin/env bash
|
|
# cluster-enable-stonith.sh — enable STONITH fence agent after fence key is deployed
|
|
# Run from ha-test-node1 as root, AFTER:
|
|
# - /etc/fence-pve-ssh-key exists on both nodes
|
|
# - The fence public key is in authorized_keys on pve1.sweet.home
|
|
set -euo pipefail
|
|
|
|
VMID_NODE1="200"
|
|
VMID_NODE2="201"
|
|
PVE_HOST="pve1.sweet.home"
|
|
PVE_USER="wayne"
|
|
FENCE_KEY="/etc/fence-pve-ssh-key"
|
|
FENCE_SCRIPT="/usr/lib/ocf/resource.d/heartbeat/fence_pve_ssh"
|
|
|
|
log() { echo "[stonith-setup] $*"; }
|
|
die() { echo "[stonith-setup] ERROR: $*" >&2; exit 1; }
|
|
|
|
[[ $(id -u) -eq 0 ]] || die "must run as root"
|
|
|
|
[[ -f "$FENCE_KEY" ]] || die "fence key not found at $FENCE_KEY"
|
|
[[ -f "$FENCE_SCRIPT" ]] || die "fence script not found at $FENCE_SCRIPT"
|
|
|
|
log "Verifying fence agent can reach ${PVE_HOST}..."
|
|
if ! ssh -i "$FENCE_KEY" -o BatchMode=yes -o ConnectTimeout=10 \
|
|
-o StrictHostKeyChecking=no "${PVE_USER}@${PVE_HOST}" "sudo /usr/sbin/qm list" &>/dev/null; then
|
|
die "Cannot SSH to ${PVE_USER}@${PVE_HOST} — check authorized_keys and sudo"
|
|
fi
|
|
log "Fence agent SSH connectivity confirmed"
|
|
|
|
log "Creating Pacemaker STONITH resource..."
|
|
cibadmin --create --scope resources --xml-text "
|
|
<primitive id=\"stonith-pve-node1\" class=\"stonith\" type=\"external/fence_pve_ssh\">
|
|
<instance_attributes id=\"stonith-pve-node1-attrs\">
|
|
<nvpair id=\"stonith-node1-plug\" name=\"plug\" value=\"ha-test-node1\"/>
|
|
<nvpair id=\"stonith-node1-pve-host\" name=\"pve_host\" value=\"${PVE_HOST}\"/>
|
|
<nvpair id=\"stonith-node1-pve-user\" name=\"pve_user\" value=\"${PVE_USER}\"/>
|
|
<nvpair id=\"stonith-node1-key-file\" name=\"key_file\" value=\"${FENCE_KEY}\"/>
|
|
<nvpair id=\"stonith-node1-vmid-node1\" name=\"vmid_node1\" value=\"${VMID_NODE1}\"/>
|
|
<nvpair id=\"stonith-node1-vmid-node2\" name=\"vmid_node2\" value=\"${VMID_NODE2}\"/>
|
|
<nvpair id=\"stonith-node1-pcmk_host_list\" name=\"pcmk_host_list\" value=\"ha-test-node1\"/>
|
|
</instance_attributes>
|
|
<operations>
|
|
<op id=\"stonith-node1-monitor\" name=\"monitor\" interval=\"30s\" timeout=\"30s\"/>
|
|
</operations>
|
|
</primitive>
|
|
" 2>/dev/null || true
|
|
|
|
cibadmin --create --scope resources --xml-text "
|
|
<primitive id=\"stonith-pve-node2\" class=\"stonith\" type=\"external/fence_pve_ssh\">
|
|
<instance_attributes id=\"stonith-pve-node2-attrs\">
|
|
<nvpair id=\"stonith-node2-plug\" name=\"plug\" value=\"ha-test-node2\"/>
|
|
<nvpair id=\"stonith-node2-pve-host\" name=\"pve_host\" value=\"${PVE_HOST}\"/>
|
|
<nvpair id=\"stonith-node2-pve-user\" name=\"pve_user\" value=\"${PVE_USER}\"/>
|
|
<nvpair id=\"stonith-node2-key-file\" name=\"key_file\" value=\"${FENCE_KEY}\"/>
|
|
<nvpair id=\"stonith-node2-vmid-node1\" name=\"vmid_node1\" value=\"${VMID_NODE1}\"/>
|
|
<nvpair id=\"stonith-node2-vmid-node2\" name=\"vmid_node2\" value=\"${VMID_NODE2}\"/>
|
|
<nvpair id=\"stonith-node2-pcmk_host_list\" name=\"pcmk_host_list\" value=\"ha-test-node2\"/>
|
|
</instance_attributes>
|
|
<operations>
|
|
<op id=\"stonith-node2-monitor\" name=\"monitor\" interval=\"30s\" timeout=\"30s\"/>
|
|
</operations>
|
|
</primitive>
|
|
" 2>/dev/null || true
|
|
|
|
log "Enabling STONITH..."
|
|
crm_attribute -t crm_config -n stonith-enabled -v true
|
|
|
|
# Restore quorum policy to stop (needed with STONITH)
|
|
crm_attribute -t crm_config -n no-quorum-policy -v stop
|
|
|
|
log "STONITH enabled. Testing fence agent..."
|
|
if stonith_admin --list-devices; then
|
|
log "Fence devices listed successfully"
|
|
else
|
|
log "WARNING: fence device list failed — check stonith config"
|
|
fi
|
|
|
|
log "STONITH setup complete. Cluster is now fully HA."
|