Proxmox worker, uptime, backup, tagged deploy

scripts/create-worker.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+# Create (or reuse) LXC 510 on this Proxmox host, bootstrap marchon + sshd + host-deps.
+# Run on NS1 as marchon (sudo). Does not publish NATS on vmbr0.
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+# shellcheck disable=SC1091
+. "$ROOT/guest.env"
+if [[ ! -f /etc/pve/local/.members ]] && [[ ! -d /etc/pve/nodes ]]; then
+  echo "not a Proxmox host" >&2
+  exit 1
+fi
+export PATH="/usr/sbin:/usr/bin:/bin:$PATH"
+if ! command -v pct >/dev/null; then
+  echo "pct missing (need /usr/sbin/pct on the Proxmox host)" >&2
+  exit 1
+fi
+if [[ ! -f "$TEMPLATE" ]]; then
+  echo "missing template $TEMPLATE" >&2
+  exit 1
+fi
+if ! sudo pct status "$VMID" >/dev/null 2>&1; then
+  echo "pct create $VMID $GUEST_HOSTNAME $IP"
+  sudo pct create "$VMID" "$TEMPLATE" \
+    --hostname "$GUEST_HOSTNAME" \
+    --memory "$MEMORY" --cores "$CORES" --swap 512 \
+    --net0 "name=eth0,bridge=${BRIDGE},ip=${IP},gw=${GW},type=veth" \
+    --rootfs "${STORAGE}:${DISK}" \
+    --unprivileged 1 --onboot 1 --nameserver "$DNS" \
+    --features nesting=1 \
+    --ostype ubuntu
+else
+  echo "CT $VMID already exists"
+fi
+sudo pct start "$VMID" 2>/dev/null || true
+for i in $(seq 1 30); do
+  sudo pct exec "$VMID" -- true 2>/dev/null && break
+  sleep 2
+done
+PUB=""
+[[ -f "$HOME/.ssh/id_ed25519.pub" ]] && PUB="$(cat "$HOME/.ssh/id_ed25519.pub")"
+[[ -z "$PUB" && -f "$HOME/.ssh/authorized_keys" ]] && PUB="$(head -1 "$HOME/.ssh/authorized_keys")"
+[[ -n "$PUB" ]] || { echo "no ssh public key for $USER_NAME" >&2; exit 1; }
+if [[ ! -f "$HOME/.ssh/id_ed25519" ]]; then
+  ssh-keygen -t ed25519 -N "" -f "$HOME/.ssh/id_ed25519" -C "ns1-to-px-worker"
+  PUB="$(cat "$HOME/.ssh/id_ed25519.pub")"
+fi
+sudo pct exec "$VMID" -- bash -lc "
+set -e
+export DEBIAN_FRONTEND=noninteractive
+apt-get update -qq
+apt-get install -y --no-install-recommends openssh-server sudo curl git ca-certificates python3 make g++ xz-utils
+id $USER_NAME >/dev/null 2>&1 || useradd -m -s /bin/bash $USER_NAME
+echo '$USER_NAME ALL=(ALL) NOPASSWD:ALL' >/etc/sudoers.d/90-$USER_NAME
+chmod 440 /etc/sudoers.d/90-$USER_NAME
+install -d -m 700 -o $USER_NAME -g $USER_NAME /home/$USER_NAME/.ssh
+grep -qxF '$PUB' /home/$USER_NAME/.ssh/authorized_keys 2>/dev/null || echo '$PUB' >>/home/$USER_NAME/.ssh/authorized_keys
+chown $USER_NAME:$USER_NAME /home/$USER_NAME/.ssh/authorized_keys
+chmod 600 /home/$USER_NAME/.ssh/authorized_keys
+systemctl enable --now ssh
+"
+HOST_IP="${IP%%/*}"
+echo "guest $GUEST_HOSTNAME $HOST_IP"
+# NATS private proxy on the Proxmox host
+if ! ss -lnt | grep -q "10.10.10.1:4222"; then
+  if command -v socat >/dev/null; then
+    sudo cp "$ROOT/scripts/nats-private-proxy.service" /etc/systemd/system/verae-nats-private-proxy.service
+    sudo systemctl daemon-reload
+    sudo systemctl enable --now verae-nats-private-proxy.service || true
+  else
+    sudo apt-get install -y socat || sudo apt-get install -y socat
+    sudo cp "$ROOT/scripts/nats-private-proxy.service" /etc/systemd/system/verae-nats-private-proxy.service
+    sudo systemctl daemon-reload
+    sudo systemctl enable --now verae-nats-private-proxy.service
+  fi
+fi
+ssh -o BatchMode=yes -o StrictHostKeyChecking=accept-new -o ConnectTimeout=8 \
+  -i "$HOME/.ssh/id_ed25519" "$USER_NAME@$HOST_IP" 'echo ssh_ok' \
+  || echo "ssh not ready yet — retry: ssh $USER_NAME@$HOST_IP"
+echo "NATS for guests: nats://${NATS_PRIVATE}:${NATS_PORT} (never on vmbr0)"
+echo "next: on the guest, clone verae-bootstrap type proxmox-worker"

scripts/nats-private-proxy.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Proxy loopback NATS onto vmbr1 (10.10.10.1:4222) for Proxmox guests
+After=network.target
+
+[Service]
+Type=simple
+# Public NIC must stay unbound. Loopback NATS remains 127.0.0.1:4222.
+ExecStart=/usr/bin/socat TCP-LISTEN:4222,bind=10.10.10.1,reuseaddr,fork TCP:127.0.0.1:4222
+Restart=always
+RestartSec=2
+
+[Install]
+WantedBy=multi-user.target

scripts/test.sh

@@ -0,0 +1,9 @@
+#!/usr/bin/env bash
+set -euo pipefail
+ROOT="$(cd "$(dirname "$0")/.." && pwd)"
+bash -n "$ROOT/scripts/create-worker.sh"
+test -f "$ROOT/guest.env"
+test -f "$ROOT/scripts/nats-private-proxy.service"
+grep -q 'bind=10.10.10.1' "$ROOT/scripts/nats-private-proxy.service"
+grep -q vmbr1 "$ROOT/guest.env"
+echo OK