wangjia
3d5bac66b4
IaC 面 (infra/) 与控制面 (server/internal/provision) 双产出，落地 doc/04 §4 「节点是牲口」弹性拓扑与 make-before-break 一键更换。 server/internal/provision: - CloudAdapter 适配层 + Registry（首发 vultr 消耗品池 / hetzner 精品池各一）； 厂商凭证仅从 PROVISION_<VENDOR>_* env 注入，不入库不入 git。 - ProvisionService：CreateNode(幂等键重放不重复开机)、DestroyNode(幂等)、 RotateIP(换 IP 不换机 + version bump)、ListProviders。 - Replace 一键更换：先建后拆，新机 up 先于旧机 draining（容量不下降）， replacement_uuid 幂等键 + replacements 表分步记录，崩溃可续跑不重复。 - RotatePool：池内滚动轮换，并发度 1–2。 - cmd/nodectl CLI：create/destroy/rotate-ip/replace/rotate-pool/providers。 - 单测（mock 厂商 API + 内存 Store）：幂等重放、make-before-break 时序断言、 开机失败/探活超时→destroyed+失败计数+告警钩子、崩溃续跑、RotatePool。 infra/: - terraform/：探针机 + 控制面基线模块化（probe / control-plane）+ README， 低频基线进 state，节点不进 Terraform。 - cloud-init/node.yaml.tmpl：节点引导模板（注入一次性 bootstrap token，task #5）。 - identity-isolation.md：身份隔离登记表（doc/06 §2 红线，无任何凭证）。 migrations/000008：nodes 增 provider_instance_id/elastic_ip_id、node_events 增 ip_rotated、provision_idempotency / replacements 表（附加式，不动现网）。 红线：仅面向新厂商池，绝不纳管现网生产 EC2(deploy/ marzban)。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
1.9 KiB
1.9 KiB
infra/ — elastic-node infrastructure
This directory is the IaC half of the elastic-node base (task #14). The
control-plane half — vendor adapters and the make-before-break orchestration
— lives in ../server/internal/provision.
infra/
terraform/ baseline resources: probe machines + control-plane env
cloud-init/
node.yaml.tmpl data-plane node bootstrap (rendered by provision svc)
identity-isolation.md per-asset identity isolation register (doc/06 §2)
Division of labour (doc/04 §4)
- Terraform (
terraform/) — low-frequency baseline only (probes, control plane). These are in Terraform state. - Provision service (
server/internal/provision) — high-frequency, minute-scale, idempotent node open/退机 via vendor APIs. Nodes are cattle and are never in Terraform state.
cloud-init/node.yaml.tmpl
The entire persistent footprint of a data-plane node: sing-box + agent + a
one-time bootstrap token (doc/04 §2). It is a Go text/template rendered by the
provision service's CloudInitRenderer, injecting:
NodeUUID, BootstrapToken (task #5), Region, Role, Tier,
ControlPlaneURL.
The rendered output carries the one-time enrollment token and must not be
logged. The agent self-registers over mTLS (task #6); the control plane then
drives the node provisioning → probing → up.
Red lines (doc/06 §2)
- Everything here targets the new vendor pools. It must never manage the
production EC2 host (the
deploy/marzban machine). - Credentials are never committed: Terraform tokens via
TF_VAR_*/ CI secrets, vendor API keys viaPROVISION_<VENDOR>_*env consumed by the provision service. Theproviderstable stores onlyname/api_kind/regions/pool/enabled. - Each vendor/domain/account is an independent identity with zero cross-linkage;
see
identity-isolation.md.