Archived
beatzaplentyandClaude Sonnet 4.6
bf4836efac
Check NixOS configurations / eval-hosts (push) Failing after 17m31s
Renumber internal HA bridges so VLAN ID matches IP third octet: vmbr1 (cluster): 192.168.4.x → 192.168.10.x (VLAN 10, /29) vmbr2 (storage): 192.168.5.x → 192.168.20.x (VLAN 20, /24) Enforce protocol separation at the firewall on both HA nodes: - iSCSI (3260/tcp): storage-client subnet (192.168.20.0/24) only - NFS (111,2049,20048 tcp+udp): LAN subnet (192.168.2.0/24) only - Cluster subnet (192.168.10.224/29) accepted wholesale (DRBD+Corosync) Moves from allowedTCPPorts/allowedUDPPorts to source-restricted extraCommands rules on the nixos-fw chain. NFS exports reduced to LAN-only (drop haClientCidr lines from mkNfsExports). Storage-client network clients use iSCSI only; no NFS on VLAN 20. All HA script VIP/storage IP defaults updated to match. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01J8djTWdXVzXZc99iujU6T2
52 lines
2.0 KiB
Nix
52 lines
2.0 KiB
Nix
# HA file server build type: DRBD + XFS + LIO iSCSI + NFS, managed by
|
|
# Corosync + Pacemaker. Both ha-server-1 and ha-server-2 use this type.
|
|
#
|
|
# NFS start/stop:
|
|
# services.nfs.server.enable = true configures /etc/exports, wires up
|
|
# rpcbind, and loads kernel modules — but nfs-server.service.wantedBy is
|
|
# force-cleared so systemd does NOT auto-start it at boot. Pacemaker's
|
|
# ha-group resource group (configured by scripts/ha/cluster-init.sh)
|
|
# starts and stops nfs-server as part of the failover sequence after the
|
|
# XFS mount and iSCSI target are brought up on the new Active node.
|
|
#
|
|
# Beszel agent:
|
|
# Enabled here via enable-agent.nix. The agent KEY (used to pair with
|
|
# the Beszel hub) is not set yet — add it to hosts/ha-server-{1,2}/host.nix
|
|
# under services.beszel.agent.environment.KEY once the hub accepts the
|
|
# new agents, following the pattern in hosts/server/host.nix.
|
|
{ lib, pkgs, vars, ... }:
|
|
|
|
let
|
|
# Generates /etc/exports lines for all nfsShares data entries.
|
|
# NFS is LAN-only (VLAN 2). Storage-client subnet (VLAN 20) uses iSCSI only.
|
|
mkNfsExports = storageRoot:
|
|
lib.concatMapStrings
|
|
(share:
|
|
" ${storageRoot}/${share.subpath} ${vars.lanCidr}${vars.nfsShares.options}\n")
|
|
(lib.filter builtins.isAttrs (lib.attrValues vars.nfsShares));
|
|
in
|
|
{
|
|
imports = [
|
|
../ha/pacemaker-stack.nix
|
|
../ha/iscsi-target.nix
|
|
../ha/cluster-config.nix
|
|
../beszel/enable-agent.nix
|
|
];
|
|
|
|
# xfsprogs: mkfs.xfs/xfs_info needed by cluster-init.sh.
|
|
# openiscsi: iscsiadm needed by acceptance-tests.sh T4 (iSCSI discovery check).
|
|
environment.systemPackages = [ pkgs.xfsprogs pkgs.openiscsi ];
|
|
|
|
services.nfs.server = {
|
|
enable = true;
|
|
exports = mkNfsExports vars.haStorageRoot;
|
|
};
|
|
|
|
# Pacemaker controls nfs-server — prevent systemd from starting it at boot
|
|
# on both nodes (only the Active node should be serving NFS).
|
|
systemd.services.nfs-server.wantedBy = lib.mkForce [ ];
|
|
|
|
# Same reason as server.nix: exports use standard auth, not Kerberos.
|
|
systemd.services.rpc-svcgssd.enable = false;
|
|
}
|