mirror of
https://github.com/immich-app/yucca.git
synced 2026-09-30 21:37:50 +08:00
Andy Molenda
63087f6850
* feat(ceph): import yucca-ceph ansible + terraform infrastructure
Imports the yucca-ceph Ansible tree into ansible/ceph/ and adds the
Terraform stack at tf/ that drives it. Cuts over from ansible-vault
to the hybrid secrets architecture (TF as inventory authority, 1P
as secrets store, op-inject at deploy time) in one atomic move.
Source: internal yucca-ceph working tree; fresh subtree-style
import, history not preserved. Andy continues operating sietch +
painbox post-merge; yucca-team hosts the code and reviews changes.
What it adds:
- sietch (3-node Austin, production Ceph S3 backend, untouched
by this PR)
- painbox (single-node Hetzner SX295 in Helsinki) as a second
deployable cluster
- Future clusters land by appending to clusters.auto.tfvars in
the matching environment stack (tf/deployment/<env>/ceph/) —
no per-cluster TF code required
How it works (full map: ansible/ceph/docs/architecture.md):
- tf/shared/modules/ceph-cluster renders inventory.ini variants
+ secrets.yml.tpl per cluster from clusters.auto.tfvars
- secrets.yml.tpl carries op:// refs; `op inject -f` resolves
them at deploy time from the matching yucca_tf_<env> vault
- State in OVH yucca-tf-state bucket (key ceph/<env>/<stack>/)
- 11 ADRs capture the decisions: ansible/ceph/docs/adr/
Out of scope (intentional):
- LUKS keys not yet in 1P (deferred until hybrid is stable)
- tf/shared/modules/ceph-cluster/secrets.tf.disabled is dormant;
today's 1P items via `op item create` per
ansible/ceph/docs/adding-a-cluster.md
- Talos K8s on sietch is a separate workstream
Atomicity + rollback: TF-rendered inventory + secrets-template
files are gitignored (TF generates them) and ansible-vault removal
is coupled to the op-inject path. Splitting this PR lands in a
non-bootable state — merge as one unit. The merge itself is
reversible via `git revert` until the post-merge `tf:apply` runs;
after apply, full rollback needs state restore or `tofu state mv`
(land + validate before applying).
Dev-env impact: adds opentofu + terragrunt to yucca root mise tools
plus a self-contained ansible/ceph/.mise.toml. No new commands or
prereqs for immich-side contributors who don't touch ceph or run
tf:* tasks.
Verification:
- `mise run lint` (from ansible/ceph/): 130 files, 0 warnings
- `mise run check`: 19 playbooks parse clean
- `mise run tf:plan`: succeeds; 7 expected file path-rename
replacements (3 painbox + 4 sietch). State drift from import,
no cluster-side change.
- painbox deployed 2026-04-26 on the new code path: Bookworm +
Ceph Tentacle, 15 OSDs (14 HDD + 1 SSD) up + in, mon/mgr/rgw
running. HEALTH_WARN is expected on a single-node cluster.
Post-merge: from the yucca root, `mise run tf:apply` flips the
bucket state to the new monorepo paths (the 7 renames above).
* fix(ceph): exempt ansible/ and tf/ subtrees from root prettier
The imported infrastructure subtrees enforce their own format
conventions (yamllint + ansible-lint inside ansible/ceph/; tofu fmt
inside tf/). Prettier on ansible YAML reflows long Jinja2 expressions
and shell command blocks in unwanted ways, so root prettier checks
are skipped for both subtrees.
Also reformat root README.md table column alignment to match prettier
conventions (only the imported subtrees are exempt; yucca-side files
including the root README still follow root prettier rules).
* fix(ceph): clean up secrets tmpfile after ansible-playbook exits
`ansible-play.sh` rendered the resolved secrets file via `op inject`
into a `mktemp` tmpfile, set up a `trap 'rm -f "$TMPFILE"' EXIT INT
TERM`, then `exec`'d ansible-playbook. The `exec` replaced the bash
shell entirely, so the EXIT trap never fired — every play left a
plaintext-secrets file in /tmp.
In practice this was masked because /tmp is tmpfs (RAM only on this
operator's setup), so files evaporate on reboot. But within an
operator session, files accumulated linearly with each playbook
invocation. Recent count on the import-PR session: 38 files.
Drop the `exec`. With `set -euo pipefail` already on, bash:
- propagates ansible-playbook's exit code (set -e)
- fires the EXIT trap before exiting (always)
- cleans up the tmpfile on success, failure, or signal
Verified: `CEPH_ENV=... scripts/ansible-play.sh status.yml
--syntax-check` creates and removes the tmpfile within the same
invocation — /tmp is clean before and after.
`scripts/preflight.sh` uses the same trap pattern but does not
`exec`, so its tmpfile cleanup was already correct (and the suffix
differs: `-secrets-test.yml` vs `-secrets.yml`, confirming
ansible-play.sh as the sole offender).
57 lines
2.1 KiB
YAML
57 lines
2.1 KiB
YAML
---
|
|
# Phase 1: Prerequisites (all nodes)
|
|
|
|
# /etc/hosts is managed by the baseline role.
|
|
|
|
- name: Ensure keyrings directory exists
|
|
ansible.builtin.file:
|
|
path: /etc/apt/keyrings
|
|
state: directory
|
|
mode: '0755'
|
|
|
|
- name: Add Ceph release GPG key
|
|
ansible.builtin.shell: |
|
|
set -o pipefail
|
|
curl -fsSL {{ ceph_repo_key_url }} | gpg --dearmor -o /etc/apt/keyrings/ceph.gpg
|
|
args:
|
|
creates: /etc/apt/keyrings/ceph.gpg
|
|
executable: /bin/bash
|
|
|
|
- name: Add Ceph Tentacle repository
|
|
ansible.builtin.copy:
|
|
content: "deb [signed-by=/etc/apt/keyrings/ceph.gpg] {{ ceph_repo_url }} bookworm main\n"
|
|
dest: /etc/apt/sources.list.d/ceph.list
|
|
mode: '0644'
|
|
|
|
- name: Update apt cache
|
|
# Always refresh — no cache_valid_time. Hetzner installimage runs apt
|
|
# during install, leaving the cache "fresh" (~minutes old) but without the
|
|
# Ceph repo's Packages file. cache_valid_time=3600 here would skip refresh
|
|
# and apt install would only see Debian's older cephadm (16.x) → version
|
|
# pin fails. Always-refresh is the safe default for any new repo addition.
|
|
ansible.builtin.apt:
|
|
update_cache: true
|
|
|
|
# Podman ecosystem, diagnostic tools, and service enablement are
|
|
# handled by the baseline role. This task installs only Ceph-specific
|
|
# packages that baseline doesn't cover.
|
|
|
|
- name: Install cephadm and Ceph-specific dependencies
|
|
ansible.builtin.apt:
|
|
name:
|
|
- "cephadm={{ ceph_release_version }}"
|
|
- "ceph-common={{ ceph_release_version }}"
|
|
- python3-asyncssh
|
|
state: present
|
|
|
|
# dbus, chrony, and podman.socket are enabled by the baseline role.
|
|
|
|
- name: Disable sntrup761 post-quantum kex (hangs with asyncssh/cephadm)
|
|
ansible.builtin.copy:
|
|
# yamllint disable-line rule:line-length
|
|
content: >-
|
|
KexAlgorithms curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group14-sha256
|
|
dest: /etc/ssh/sshd_config.d/no-sntrup.conf
|
|
mode: '0644'
|
|
notify: Restart sshd
|