Archived
beatzaplentyandClaude Sonnet 4.6
8d43b7039c
Check NixOS configurations / eval-hosts (push) Successful in 10m39s
Infrastructure changes already applied to pve1:
- vmbr2 internal bridge created (192.168.5.0/24, no physical uplink)
- VM 200 (ha-server-1): net2 added → vmbr2 (ens20)
- VM 201 (ha-server-2): net2 added → vmbr2 (ens20)
- CT 105 (docker): net1 added → vmbr2 (eth1)
- VM 101 (server): net1 added → vmbr2 (ens19) — needs reboot to activate
NixOS config (deploy to ha nodes to complete; docker/server at cutover):
- ha-server-{1,2}/host.nix: ens20 with 192.168.5.{228,227}/24
- docker/host.nix: eth1 with 192.168.5.225/24
- server/host.nix: ens19 with 192.168.5.226/24
- cluster-config.nix: corosync ring1 on LAN IPs as backup heartbeat path
- cluster-config.nix: allow haClientCidr (192.168.5.0/24) in iptables
- ha-server.nix: NFS exports now allow both lanCidr and haClientCidr
- VIP moves from 192.168.2.229 (vmbr0/LAN) to 192.168.5.229 (vmbr2)
- iSCSI portal to be rebound from [::0] to 192.168.5.229 at cutover
variables.nix: haStorageCidr corrected to 192.168.4.224/29; new vars:
vmStorageClientInterface, lxcStorageInterface, haServer{1,2}ClientIp,
dockerStorageIp, serverStorageIp, haClientCidr/PrefixLength; haServerVip
updated to 192.168.5.229.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
54 lines
2.2 KiB
Nix
54 lines
2.2 KiB
Nix
# HA file server build type: DRBD + XFS + LIO iSCSI + NFS, managed by
|
|
# Corosync + Pacemaker. Both ha-server-1 and ha-server-2 use this type.
|
|
#
|
|
# NFS start/stop:
|
|
# services.nfs.server.enable = true configures /etc/exports, wires up
|
|
# rpcbind, and loads kernel modules — but nfs-server.service.wantedBy is
|
|
# force-cleared so systemd does NOT auto-start it at boot. Pacemaker's
|
|
# ha-group resource group (configured by scripts/ha/cluster-init.sh)
|
|
# starts and stops nfs-server as part of the failover sequence after the
|
|
# XFS mount and iSCSI target are brought up on the new Active node.
|
|
#
|
|
# Beszel agent:
|
|
# Enabled here via enable-agent.nix. The agent KEY (used to pair with
|
|
# the Beszel hub) is not set yet — add it to hosts/ha-server-{1,2}/host.nix
|
|
# under services.beszel.agent.environment.KEY once the hub accepts the
|
|
# new agents, following the pattern in hosts/server/host.nix.
|
|
{ lib, pkgs, vars, ... }:
|
|
|
|
let
|
|
# Generates /etc/exports lines for all nfsShares data entries. Each share
|
|
# gets two export lines — one for LAN clients (pxe-boot, proxmox host) and
|
|
# one for storage-client-subnet clients (docker, server via vmbr2).
|
|
mkNfsExports = storageRoot:
|
|
lib.concatMapStrings
|
|
(share:
|
|
" ${storageRoot}/${share.subpath} ${vars.lanCidr}${vars.nfsShares.options}\n" +
|
|
" ${storageRoot}/${share.subpath} ${vars.haClientCidr}${vars.nfsShares.options}\n")
|
|
(lib.filter builtins.isAttrs (lib.attrValues vars.nfsShares));
|
|
in
|
|
{
|
|
imports = [
|
|
../ha/pacemaker-stack.nix
|
|
../ha/iscsi-target.nix
|
|
../ha/cluster-config.nix
|
|
../beszel/enable-agent.nix
|
|
];
|
|
|
|
# xfsprogs: mkfs.xfs/xfs_info needed by cluster-init.sh.
|
|
# openiscsi: iscsiadm needed by acceptance-tests.sh T4 (iSCSI discovery check).
|
|
environment.systemPackages = [ pkgs.xfsprogs pkgs.openiscsi ];
|
|
|
|
services.nfs.server = {
|
|
enable = true;
|
|
exports = mkNfsExports vars.haStorageRoot;
|
|
};
|
|
|
|
# Pacemaker controls nfs-server — prevent systemd from starting it at boot
|
|
# on both nodes (only the Active node should be serving NFS).
|
|
systemd.services.nfs-server.wantedBy = lib.mkForce [ ];
|
|
|
|
# Same reason as server.nix: exports use standard auth, not Kerberos.
|
|
systemd.services.rpc-svcgssd.enable = false;
|
|
}
|