graham/infra
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

update

Browse source
This commit is contained in:
Graham McIntire 2026-04-04 17:40:50 -05:00
parent fc934290b8
commit 7494b04d2c
No known key found for this signature in database
GPG key ID: F4ABF488E6029E59
8 changed files with 94 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

20
ansible/host_vars/skippy.w5isp.com.yml
View file

@ -8,6 +8,14 @@ ansible_ssh_common_args: '-o StrictHostKeyChecking=accept-new'
network:
skip: true
nfs_exports:
- path: /data/srtm
clients:
- host: 10.0.0.0/16
options: rw,sync,no_subtree_check,all_squash
- host: 204.110.191.1
options: ro,sync,no_subtree_check,all_squash
firewall_allow_rules:
- port: 80
proto: tcp
@ -15,3 +23,15 @@ firewall_allow_rules:
- port: 443
proto: tcp
comment: HTTPS
- port: 2049
proto: tcp
from_ip: 10.0.0.0/16
comment: NFS from internal
- port: 2049
proto: tcp
from_ip: 204.110.188.0/22
comment: NFS from VNTX
- port: 2049
proto: tcp
from_ip: 100.64.0.0/10
comment: NFS from Tailscale

1
ansible/roles/firewall/tasks/main.yml
View file

@ -130,6 +130,7 @@
rule: allow
port: "{{ item.port | string }}"
proto: "{{ item.proto }}"
from_ip: "{{ item.from_ip | default('any') }}"
comment: "{{ item.comment }}"
loop: "{{ firewall_allow_rules }}"
when:

3
ansible/roles/general/handlers/main.yml Normal file
View file

@ -0,0 +1,3 @@
---
- name: Re-export NFS shares
command: exportfs -ra

25
ansible/roles/general/tasks/debian/nfs.yml Normal file
View file

@ -0,0 +1,25 @@
---
- name: Install NFS server packages
apt:
name: nfs-kernel-server
state: present
update_cache: true
cache_valid_time: 3600
when: nfs_exports is defined
- name: Configure /etc/exports
template:
src: templates/etc/exports.j2
dest: /etc/exports
owner: root
group: root
mode: "0644"
when: nfs_exports is defined
notify: Re-export NFS shares
- name: Enable and start nfs-server
systemd:
name: nfs-server
enabled: true
state: started
when: nfs_exports is defined

5
ansible/roles/general/tasks/main.yml
View file

@ -33,3 +33,8 @@
tags:
- icinga2
- monitoring
- import_tasks: debian/nfs.yml
when: ansible_os_family == "Debian"
tags:
- nfs

6
ansible/roles/general/templates/etc/exports.j2 Normal file
View file

@ -0,0 +1,6 @@
# /etc/exports - managed by Ansible
# Do not edit manually; changes will be overwritten.
{% for export in nfs_exports %}
{{ export.path }} {% for client in export.clients %}{{ client.host }}({{ client.options }}) {% endfor %}
{% endfor %}

25
talos/CLAUDE.md
View file

@ -6,7 +6,7 @@ This document contains notes on how the Talos home cluster was created and how t
- **Cluster Name**: home-cluster
- **Kubernetes Version**: v1.35.0
- **Talos Version**: v1.12.1
- **Talos Version**: v1.12.6
- **Control Plane Nodes**: 3 (10.0.15.1-3)
- **Worker Nodes**: 3 (10.0.15.4-6)
- **API Endpoint**: https://10.0.15.1:6443
@ -245,6 +245,23 @@ kubectl get nodes
5. **Node Naming**: Kubernetes node names come from the Talos hostname configuration, not VM names in Proxmox.
6. **Recreating Individual VMs from Template**: The OpenTofu VM definitions have been removed. To recreate a single VM directly on Proxmox:
```bash
ssh root@<proxmox-node> "qm clone 9001 <VMID> --name <hostname> --full true --storage local-lvm"
ssh root@<proxmox-node> "qm set <VMID> --cpu host --balloon 0 --numa 0 --sockets 1 --net0 virtio=<MAC>,bridge=vmbr0,firewall=0 --onboot 1 --agent enabled=1,fstrim_cloned_disks=0,type=virtio --vga std,memory=16"
ssh root@<proxmox-node> "qm resize <VMID> scsi0 64G"
ssh root@<proxmox-node> "qm start <VMID>"
# Wait for DHCP, then apply config:
talosctl --talosconfig talosconfig apply-config --nodes <IP> --file configs/<hostname>.yaml --insecure
# Then upgrade to the factory image with extensions:
talosctl --talosconfig talosconfig --nodes <IP> upgrade --image factory.talos.dev/installer/613e1592b2da41ae5e265e8789429f22e121aab91cb4deb6bc3c0b6262961245:v1.12.6
```
**Critical VM settings**: `cpu: host` is required — without it, Talos boots but never gets a network address. Also set `balloon: 0`, `firewall=0` on NIC.
7. **Disk Dependencies Block Boot**: If a worker config references `/dev/sdb` for Longhorn but the Proxmox node has no passthrough NVMe disk, the `UserDiskConfigController` errors will prevent CRI and kubelet from starting. Comment out the `disks:` and `extraMounts:` sections for nodes without the extra disk.
8. **Node1 Has No NVMe**: node1 (10.0.15.101) only has a single 238GB SSD. No NVMe passthrough disk is available for Longhorn storage on talos-worker1.
## Troubleshooting
### Nodes won't accept new config
@ -277,9 +294,9 @@ talosctl --talosconfig talosconfig service --nodes 10.0.15.1
## Storage
Nodes use Proxmox Ceph for VM disks. For Kubernetes persistent storage, deploy:
- Ceph CSI driver (to use Proxmox Ceph directly)
- Or Longhorn for cluster-managed storage
- **VM boot disks**: local-lvm on each Proxmox node (no ceph storage available)
- **Longhorn**: Workers 2 and 3 have passthrough NVMe disks (`/dev/sdb`) for Longhorn persistent storage. Worker 1 (node1) has no NVMe disk.
- **Longhorn StorageClass**: `longhorn` (default)
## Maintenance

24
talos/configs/talos-worker1.yaml
View file

@ -31,14 +31,14 @@ machine:
# extraArgs:
# key: value
extraMounts:
- destination: /var/mnt/longhorn
type: bind
source: /var/mnt/longhorn
options:
- bind
- rshared
- rw
# extraMounts:
# - destination: /var/mnt/longhorn
# type: bind
# source: /var/mnt/longhorn
# options:
# - bind
# - rshared
# - rw
# # The `extraConfig` field is used to provide kubelet configuration overrides.
# extraConfig:
@ -86,10 +86,10 @@ machine:
# model: WDC* # Disk model `/sys/block/<dev>/device/model`.
# busPath: /pci0000:00/0000:00:17.0/ata1/host0/target0:0:0/0:0:0:0 # Disk bus path.
# Extra disks to configure (Longhorn storage).
disks:
- device: /dev/sdb
partitions:
- mountpoint: /var/mnt/longhorn
# disks:
# - device: /dev/sdb
# partitions:
# - mountpoint: /var/mnt/longhorn
registries: {}
# Features describe individual Talos features that can be switched on or off.
features: