Archived
beatzaplentyandClaude Sonnet 4.6
5856d45575
- cluster-config.nix: add corosync_authkey sops binary secret
(/etc/corosync/authkey, mode 0400) and force-disable NetworkManager
(common config enables it; HA nodes need stable static IP networking)
- hosts/ha-server-{1,2}/host.nix: add host-token.nix import for
sops-managed beszel-token; add KEY placeholder for beszel hub pairing
- .sops.yaml: add creation rules for secrets/ha-server-{1,2}.yaml and
secrets/ha-corosync-authkey (admin-only until sync-host-keys.sh runs)
- secrets/ha-server-{1,2}.yaml, secrets/ha-corosync-authkey: stub files
so eval passes before real secrets are provisioned
Bootstrap order (post-merge):
1. bash scripts/secrets/sync-host-keys.sh proxmox-ha-server-1
2. bash scripts/secrets/sync-host-keys.sh proxmox-ha-server-2
3. sops updatekeys secrets/common.yaml (grants HA nodes common secrets)
4. sops secrets/ha-server-{1,2}.yaml (set beszel-token values)
5. On node1: corosync-keygen; sops -e --input-type binary
/etc/corosync/authkey > secrets/ha-corosync-authkey; git add/commit
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HaH1cSGvhogRP5ExoF6nD8
27 lines
632 B
Nix
27 lines
632 B
Nix
{ vars, ... }:
|
|
{
|
|
imports = [
|
|
(import ../../modules/beszel/host-token.nix {
|
|
name = "ha-server-2";
|
|
sopsFile = ../../secrets/ha-server-2.yaml;
|
|
})
|
|
];
|
|
|
|
networking = {
|
|
hostName = vars.haServer2Host;
|
|
hostId = "7e8f9a0b";
|
|
useDHCP = false;
|
|
interfaces.ens18.ipv4.addresses = [{
|
|
address = vars.haServer2Ip;
|
|
prefixLength = 24;
|
|
}];
|
|
defaultGateway = "192.168.2.1";
|
|
nameservers = [ "192.168.2.1" "8.8.8.8" ];
|
|
};
|
|
|
|
# Set KEY after pairing this host with the beszel hub; the token is sops-managed.
|
|
services.beszel.agent.environment.KEY = "";
|
|
|
|
system.stateVersion = "26.05";
|
|
}
|