George Lambert
7a5e25639e
Some checks are pending
offline / test (push) Waiting to run
NS1 is the Proxmox host. verae-proxmox creates LXC 510 (verae-px-worker 10.10.10.20 on vmbr1) with a private NATS proxy on 10.10.10.1:4222. verae-uptime GET-watches public doors; verae-backup snapshots SQLite and worm/tree data; verae-deploy does host-deps + checkout + npm ci. Fleet overlays/ns1 are checked in (start.sh no longer rewrites JSON). User systemd + linger for keep and fleet survive reboot.
50 lines
1.9 KiB
Markdown
50 lines
1.9 KiB
Markdown
# 3. Proxmox (NS1 is the hypervisor)
|
|
|
|
**NS1.GEORGELAMBERT.ORG** (`70.88.205.138`) **is** the Proxmox host. Control plane, Caddy, keep, and fleet run on the host. Extra worm/tree copies run in an **unprivileged Ubuntu LXC** on the private bridge.
|
|
|
|
| Bridge | Address | Use |
|
|
|--------|---------|-----|
|
|
| `vmbr0` | `70.88.205.138/28` | Public HTTPS / SSH. **Never NATS.** |
|
|
| `vmbr1` | `10.10.10.1/24` | Private. PKI `.11`, peergos-a `.12`, peergos-b `.13`, **verae-px-worker `.20`** |
|
|
|
|
## Guest we actually deploy
|
|
|
|
| | |
|
|
|--|--|
|
|
| VMID | **510** |
|
|
| Name | `verae-px-worker` |
|
|
| Template | `ubuntu-24.04-standard_24.04-2_amd64.tar.zst` (`local`) |
|
|
| Disk | `SSD2` 16G |
|
|
| RAM / CPU | 2G / 2 |
|
|
| Roles | `tree-node`, `archive-worm` |
|
|
| Fleet id | `px-worker` |
|
|
| NATS | `nats://10.10.10.1:4222` (host `socat` → `127.0.0.1:4222`) |
|
|
|
|
Repo: [verae-proxmox](https://git.georgelambert.org/marchon/verae-proxmox)
|
|
|
|
```bash
|
|
# on NS1
|
|
git clone ssh://git@git.georgelambert.org:2223/marchon/verae-proxmox.git
|
|
cd verae-proxmox
|
|
bash scripts/create-worker.sh
|
|
ssh -i ~/.ssh/id_ed25519 marchon@10.10.10.20 true
|
|
```
|
|
|
|
On the guest, bootstrap type `proxmox-worker` ([verae-bootstrap](https://git.georgelambert.org/marchon/verae-bootstrap)). Then `verae-fleet ssh-check px-worker` and set `"enabled": true` in `overlays/ns1/machines.json`.
|
|
|
|
## NATS for guests
|
|
|
|
Loopback NATS on the host stays `127.0.0.1:4222`. `verae-nats-private-proxy.service` binds **only** `10.10.10.1:4222`. Do not listen on `vmbr0`.
|
|
|
|
## Suggested future guests (not created by create-worker.sh)
|
|
|
|
| Guest | Role |
|
|
|-------|------|
|
|
| `nats-b` `nats-c` | Extra JetStream nodes on `vmbr1` when leaving all-in-one |
|
|
| more `worker-*` | Same recipe as 510 with the next free `10.10.10.2x` |
|
|
|
|
## Edge / Caddy
|
|
|
|
Stay on the **host** (already live). Do not put zappier-edge in the worker CT.
|
|
|
|
Operator console: `https://fleet.zapier.georgelambert.org/` · overlay `packages/verae-fleet/overlays/ns1/`.
|