wangjia
3d5bac66b4
IaC 面 (infra/) 与控制面 (server/internal/provision) 双产出，落地 doc/04 §4 「节点是牲口」弹性拓扑与 make-before-break 一键更换。 server/internal/provision: - CloudAdapter 适配层 + Registry（首发 vultr 消耗品池 / hetzner 精品池各一）； 厂商凭证仅从 PROVISION_<VENDOR>_* env 注入，不入库不入 git。 - ProvisionService：CreateNode(幂等键重放不重复开机)、DestroyNode(幂等)、 RotateIP(换 IP 不换机 + version bump)、ListProviders。 - Replace 一键更换：先建后拆，新机 up 先于旧机 draining（容量不下降）， replacement_uuid 幂等键 + replacements 表分步记录，崩溃可续跑不重复。 - RotatePool：池内滚动轮换，并发度 1–2。 - cmd/nodectl CLI：create/destroy/rotate-ip/replace/rotate-pool/providers。 - 单测（mock 厂商 API + 内存 Store）：幂等重放、make-before-break 时序断言、 开机失败/探活超时→destroyed+失败计数+告警钩子、崩溃续跑、RotatePool。 infra/: - terraform/：探针机 + 控制面基线模块化（probe / control-plane）+ README， 低频基线进 state，节点不进 Terraform。 - cloud-init/node.yaml.tmpl：节点引导模板（注入一次性 bootstrap token，task #5）。 - identity-isolation.md：身份隔离登记表（doc/06 §2 红线，无任何凭证）。 migrations/000008：nodes 增 provider_instance_id/elastic_ip_id、node_events 增 ip_rotated、provision_idempotency / replacements 表（附加式，不动现网）。 红线：仅面向新厂商池，绝不纳管现网生产 EC2(deploy/ marzban)。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
65 lines
2.7 KiB
Cheetah
65 lines
2.7 KiB
Cheetah
## template: jinja-free Go text/template — rendered by
|
|
## server/internal/provision (CloudInitRenderer). Fields:
|
|
## {{.NodeUUID}} {{.BootstrapToken}} {{.Region}} {{.Role}} {{.Tier}} {{.ControlPlaneURL}}
|
|
##
|
|
## "Nodes are cattle, not pets" (doc/04 §2): this is the ENTIRE persistent
|
|
## footprint of a data-plane node — sing-box + agent binaries + a one-time
|
|
## bootstrap token. Zero user DB, zero logs, zero persistent state.
|
|
##
|
|
## SECURITY: the rendered output carries a one-time bootstrap token. It MUST NOT
|
|
## be logged. The token is consumed exactly once during mTLS enrollment (task #5)
|
|
## and is useless afterwards.
|
|
#cloud-config
|
|
|
|
write_files:
|
|
# Node identity + enrollment parameters consumed by the agent on first boot.
|
|
- path: /etc/pangolin/bootstrap.env
|
|
permissions: "0600"
|
|
owner: root:root
|
|
content: |
|
|
PANGOLIN_NODE_UUID={{.NodeUUID}}
|
|
PANGOLIN_BOOTSTRAP_TOKEN={{.BootstrapToken}}
|
|
PANGOLIN_CONTROL_PLANE_URL={{.ControlPlaneURL}}
|
|
PANGOLIN_REGION={{.Region}}
|
|
PANGOLIN_ROLE={{.Role}}
|
|
PANGOLIN_TIER={{.Tier}}
|
|
|
|
# systemd unit: agent enrolls (mTLS) then pulls runtime config from control plane.
|
|
- path: /etc/systemd/system/pangolin-agent.service
|
|
permissions: "0644"
|
|
owner: root:root
|
|
content: |
|
|
[Unit]
|
|
Description=Pangolin node agent (self-register + config pull)
|
|
After=network-online.target
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
EnvironmentFile=/etc/pangolin/bootstrap.env
|
|
ExecStart=/usr/local/bin/pangolin-agent run
|
|
# No-log node: agent does not persist connection logs.
|
|
Restart=always
|
|
RestartSec=5
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
|
|
runcmd:
|
|
# 1. Harden: key-only SSH, no root password (doc/06 §3).
|
|
- sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
|
|
- sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
|
- systemctl restart sshd || true
|
|
# 2. Install the agent binary (pinned, checksum-verified by the install script,
|
|
# delivered out-of-band by task #6). Placeholder URL resolved at build time.
|
|
- install -d -m 0755 /etc/pangolin
|
|
- /usr/local/bin/pangolin-agent-install || true
|
|
# 3. Enroll + start. The agent reads bootstrap.env, performs mTLS enrollment,
|
|
# and the control plane flips the node provisioning → probing → up.
|
|
- systemctl daemon-reload
|
|
- systemctl enable --now pangolin-agent.service
|
|
# 4. Shred the one-time token from disk after enrollment (defence in depth).
|
|
- bash -c 'sleep 60; shred -u /etc/pangolin/bootstrap.env 2>/dev/null || rm -f /etc/pangolin/bootstrap.env'
|
|
|
|
# No swap file written to disk, no persistent data dirs — a destroyed node leaks nothing.
|