vh
d3f59aa2c5
albok-service leaves nh3-docker before unit 4 puts the personal vault and licensed books into restricted wings. On nh3-docker, portainer, portainer_agent, dockge (socket rw) and dockerd on plaintext tcp/2375 were each root over /srv/albok. The new host runs only albok-service: no socket containers and no TCP Docker API, so its Homepage tile is a static services.yaml entry. - nh3-pve-2: vmbr0 made VLAN-aware (applied by reboot, no guests running); pbs-ana storage in the new namespace nh3-pve-2, plus a 21:30 vzdump job (pbs-nh3's recursive sync mirrors it) - VM 110 nh3-albok, 10.100.50.44 on VLAN 50, Debian 13 cloud-init, 4 vCPU x86-64-v3 / 12 GiB / 100 GB; built to fleet conventions (vh 1000, infra-ops 850, docker 851) - compose: mem_limit 4g -> 8g, homepage labels removed; host port 8392 kept - cutover by tar stream, verified by digest (contents plus owner, group, mode, mtime and type identical); albok.nh3.internal now points at nh3-albok - old /srv/albok stays on nh3-docker (container removed, compose renamed) until acceptance and the operator's approval to delete it - sudo-io archive hosts and ops-log STACK_HOSTS include nh3-albok
64 lines
3.1 KiB
YAML
64 lines
3.1 KiB
YAML
# nh3-pve-2: make vmbr0 VLAN-aware so guests can sit on tagged VLANs (2026-10-04).
|
|
# scripts/elway infra-ops@10.100.250.62 --playbook playbooks/nh3-pve-2-vmbr0-vlan-aware.yaml
|
|
# then REBOOT the node (the playbook does not). First consumer: VM 110 nh3-albok on VLAN 50
|
|
# (nh3-servers), the albok-service host.
|
|
#
|
|
# Same shape as nh3-pve's vmbr0 (`bridge-vlan-aware yes`, `bridge-vids 2-4094`), where every guest
|
|
# carries `tag=50`. The host address stays untagged on the bridge (PVID 1 = the switch port's native
|
|
# nh3-mgmt), so 10.100.250.62 does not move.
|
|
#
|
|
# ⚠ Applied by REBOOT, never by a live `ifreload -a`. On 2026-10-03 a live ifreload here read the new
|
|
# vmbr0 as "not a bridge" and downed it (servers/nh3-pve-2/README.md). The syntax check below
|
|
# (`ifreload -a -s`) parses the file without touching any interface.
|
|
# ⚠ Only the vmbr0 stanza changes. `auto nic0` (the AMT port) must stay as it is: if Linux leaves that
|
|
# port down, igc powers off the PHY and AMT goes dark.
|
|
steps:
|
|
- name: refuse unless this is nh3-pve-2 with vmbr0 on nic3 and no guests
|
|
sudo: true
|
|
shell: |
|
|
set -e
|
|
test "$(hostname)" = nh3-pve-2
|
|
grep -q '^iface vmbr0 inet static' /etc/network/interfaces
|
|
grep -q 'bridge-ports nic3$' /etc/network/interfaces
|
|
grep -q '^auto nic0$' /etc/network/interfaces
|
|
test -z "$(qm list | tail -n +2)"
|
|
changed_when: "false"
|
|
when: "! grep -q 'bridge-vlan-aware yes' /etc/network/interfaces"
|
|
|
|
- name: back up /etc/network/interfaces
|
|
sudo: true
|
|
shell: cp -a /etc/network/interfaces /etc/network/interfaces.pre-vlan-aware-2026-10-04
|
|
creates: /etc/network/interfaces.pre-vlan-aware-2026-10-04
|
|
|
|
- name: add bridge-vlan-aware + bridge-vids to the vmbr0 stanza (after bridge-fd)
|
|
sudo: true
|
|
shell: |
|
|
set -e
|
|
tmp=$(mktemp)
|
|
awk '{print} /^iface vmbr0 /{inv=1} inv && /^\tbridge-fd /{print "\tbridge-vlan-aware yes"; print "\tbridge-vids 2-4094"; inv=0}' \
|
|
/etc/network/interfaces > "$tmp"
|
|
test "$(grep -c 'bridge-vlan-aware yes' "$tmp")" = 1
|
|
cat "$tmp" > /etc/network/interfaces
|
|
rm -f "$tmp"
|
|
when: "! grep -q 'bridge-vlan-aware yes' /etc/network/interfaces"
|
|
|
|
# `ifup -s` exits 1 on the PVE-default `bridge-fd 0` ("out of range 2-255") even on the file the node
|
|
# booted from, so its rc carries no signal here. The check is instead: the new file draws exactly the
|
|
# warnings the original did, nothing more.
|
|
- name: syntax-check the file without applying it (no warnings beyond the original's)
|
|
sudo: true
|
|
shell: |
|
|
set -e
|
|
old=$(ifup -a -s -i /etc/network/interfaces.pre-vlan-aware-2026-10-04 2>&1 || true)
|
|
new=$(ifup -a -s -i /etc/network/interfaces 2>&1 || true)
|
|
echo "$new"
|
|
test "$old" = "$new"
|
|
changed_when: "false"
|
|
|
|
verify:
|
|
- name: vmbr0 stanza carries both lines, nic0 untouched
|
|
shell: |
|
|
sed -n '/^iface vmbr0/,/^$/p;/^auto nic0/,/^iface nic0/p' /etc/network/interfaces
|
|
grep -q 'bridge-vlan-aware yes' /etc/network/interfaces && grep -q 'bridge-vids 2-4094' /etc/network/interfaces && grep -q '^auto nic0$' /etc/network/interfaces
|
|
changed_when: "false"
|