Files
wangjia 3d5bac66b4 feat(provision): 弹性节点基建 Terraform + 一键更换 (tsk_6u0FxmbC7Yeq)
IaC 面 (infra/) 与控制面 (server/internal/provision) 双产出,落地 doc/04 §4
「节点是牲口」弹性拓扑与 make-before-break 一键更换。

server/internal/provision:
- CloudAdapter 适配层 + Registry(首发 vultr 消耗品池 / hetzner 精品池各一);
  厂商凭证仅从 PROVISION_<VENDOR>_* env 注入,不入库不入 git。
- ProvisionService:CreateNode(幂等键重放不重复开机)、DestroyNode(幂等)、
  RotateIP(换 IP 不换机 + version bump)、ListProviders。
- Replace 一键更换:先建后拆,新机 up 先于旧机 draining(容量不下降),
  replacement_uuid 幂等键 + replacements 表分步记录,崩溃可续跑不重复。
- RotatePool:池内滚动轮换,并发度 1–2。
- cmd/nodectl CLI:create/destroy/rotate-ip/replace/rotate-pool/providers。
- 单测(mock 厂商 API + 内存 Store):幂等重放、make-before-break 时序断言、
  开机失败/探活超时→destroyed+失败计数+告警钩子、崩溃续跑、RotatePool。

infra/:
- terraform/:探针机 + 控制面基线模块化(probe / control-plane)+ README,
  低频基线进 state,节点不进 Terraform。
- cloud-init/node.yaml.tmpl:节点引导模板(注入一次性 bootstrap token,task #5)。
- identity-isolation.md:身份隔离登记表(doc/06 §2 红线,无任何凭证)。

migrations/000008:nodes 增 provider_instance_id/elastic_ip_id、node_events
增 ip_rotated、provision_idempotency / replacements 表(附加式,不动现网)。

红线:仅面向新厂商池,绝不纳管现网生产 EC2(deploy/ marzban)。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-13 14:23:39 +08:00

111 lines
3.1 KiB
Go

package providers
import (
"context"
"encoding/base64"
"os"
"github.com/wangjia/pangolin/server/internal/provision"
)
// vultrAdapter implements provision.CloudAdapter against the Vultr API v2.
// Consumable pool: cheap, hourly-billed, reserved-IP capable.
//
// Credentials: PROVISION_VULTR_API_KEY (env, independent secret).
// Default OS image: PROVISION_VULTR_OS_ID (defaults to a current Debian image).
type vultrAdapter struct {
c *httpClient
osID int
}
func newVultrFromEnv() (provision.CloudAdapter, error) {
key, err := secret("PROVISION_VULTR_API_KEY")
if err != nil {
return nil, err
}
osID := atoiDefault(os.Getenv("PROVISION_VULTR_OS_ID"), 2136) // 2136 = Debian 12 x64
return &vultrAdapter{
c: newHTTPClient("https://api.vultr.com/v2", key),
osID: osID,
}, nil
}
func (a *vultrAdapter) Kind() string { return "vultr" }
func (a *vultrAdapter) SupportsElasticIP() bool { return true } // reserved IPs
func (a *vultrAdapter) CreateInstance(ctx context.Context, in provision.CreateInput) (*provision.Instance, error) {
body := map[string]any{
"region": in.Region,
"plan": in.Plan,
"os_id": a.osID,
"label": in.Label,
"hostname": in.Label,
"user_data": base64.StdEncoding.EncodeToString([]byte(in.UserData)),
"tags": in.Tags,
"backups": "disabled",
}
if len(in.SSHKeyIDs) > 0 {
body["sshkey_id"] = in.SSHKeyIDs
}
var resp struct {
Instance struct {
ID string `json:"id"`
MainIP string `json:"main_ip"`
Region string `json:"region"`
} `json:"instance"`
}
if err := a.c.do(ctx, "POST", "/instances", body, &resp); err != nil {
return nil, err
}
return &provision.Instance{
ID: resp.Instance.ID,
IP: resp.Instance.MainIP,
Region: resp.Instance.Region,
}, nil
}
func (a *vultrAdapter) DestroyInstance(ctx context.Context, instanceID string) error {
err := a.c.do(ctx, "DELETE", "/instances/"+instanceID, nil, nil)
if err != nil && isNotFound(err) {
return nil // idempotent: already gone
}
return err
}
func (a *vultrAdapter) AttachIP(ctx context.Context, instanceID string) (string, error) {
// Allocate a reserved IPv4, then attach it to the instance.
var created struct {
ReservedIP struct {
ID string `json:"id"`
Subnet string `json:"subnet"`
} `json:"reserved_ip"`
}
if err := a.c.do(ctx, "POST", "/reserved-ips", map[string]any{
"region": "",
"ip_type": "v4",
"label": "rotate-" + instanceID,
"instance_id": instanceID,
}, &created); err != nil {
return "", err
}
return created.ReservedIP.Subnet, nil
}
func (a *vultrAdapter) ListRegions(ctx context.Context) ([]provision.Region, error) {
var resp struct {
Regions []struct {
ID string `json:"id"`
Country string `json:"country"`
City string `json:"city"`
} `json:"regions"`
}
if err := a.c.do(ctx, "GET", "/regions", nil, &resp); err != nil {
return nil, err
}
out := make([]provision.Region, 0, len(resp.Regions))
for _, r := range resp.Regions {
out = append(out, provision.Region{ID: r.ID, Country: r.Country, City: r.City})
}
return out, nil
}