wangjia
3d5bac66b4
IaC 面 (infra/) 与控制面 (server/internal/provision) 双产出，落地 doc/04 §4 「节点是牲口」弹性拓扑与 make-before-break 一键更换。 server/internal/provision: - CloudAdapter 适配层 + Registry（首发 vultr 消耗品池 / hetzner 精品池各一）； 厂商凭证仅从 PROVISION_<VENDOR>_* env 注入，不入库不入 git。 - ProvisionService：CreateNode(幂等键重放不重复开机)、DestroyNode(幂等)、 RotateIP(换 IP 不换机 + version bump)、ListProviders。 - Replace 一键更换：先建后拆，新机 up 先于旧机 draining（容量不下降）， replacement_uuid 幂等键 + replacements 表分步记录，崩溃可续跑不重复。 - RotatePool：池内滚动轮换，并发度 1–2。 - cmd/nodectl CLI：create/destroy/rotate-ip/replace/rotate-pool/providers。 - 单测（mock 厂商 API + 内存 Store）：幂等重放、make-before-break 时序断言、 开机失败/探活超时→destroyed+失败计数+告警钩子、崩溃续跑、RotatePool。 infra/: - terraform/：探针机 + 控制面基线模块化（probe / control-plane）+ README， 低频基线进 state，节点不进 Terraform。 - cloud-init/node.yaml.tmpl：节点引导模板（注入一次性 bootstrap token，task #5）。 - identity-isolation.md：身份隔离登记表（doc/06 §2 红线，无任何凭证）。 migrations/000008：nodes 增 provider_instance_id/elastic_ip_id、node_events 增 ip_rotated、provision_idempotency / replacements 表（附加式，不动现网）。 红线：仅面向新厂商池，绝不纳管现网生产 EC2(deploy/ marzban)。 Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
68 lines
2.5 KiB
Markdown
68 lines
2.5 KiB
Markdown
# `infra/terraform` — baseline infrastructure as code
|
|
|
|
Terraform here manages **only low-frequency baseline resources**:
|
|
|
|
- **probe machines** — overseas reference dial-test points (doc/04 §1, §4.2).
|
|
- **control-plane environment** — the API + MySQL + Redis host (doc/04 §5.2),
|
|
off by default because it changes rarely.
|
|
|
|
## What is deliberately NOT here
|
|
|
|
**Data-plane nodes are not in Terraform.** They are disposable cattle, created
|
|
and destroyed minute-by-minute through vendor APIs by the provision service
|
|
(`server/internal/provision`, doc/04 §4). Putting them in Terraform state would
|
|
fight the "nodes are cattle, not pets" model and serialise every open/退机
|
|
behind a state lock. Division of labour:
|
|
|
|
| concern | owner | frequency | in TF state |
|
|
|---------|-------|-----------|-------------|
|
|
| probe machines | Terraform (this dir) | low | ✅ |
|
|
| control-plane env | Terraform (this dir) | one-off | ✅ |
|
|
| data-plane nodes (entry/relay/exit) | provision service + vendor API | minutes | ❌ |
|
|
|
|
## Identity isolation (RED LINE, doc/06 §2)
|
|
|
|
Every vendor/account/domain used here MUST be an **independent identity** — its
|
|
own account, email, and crypto payment, with **zero cross-linkage** to other
|
|
assets. This Terraform code and the data-plane vendor accounts use **separate**
|
|
credentials:
|
|
|
|
- `var.hcloud_token` here is the **management/probe** account token — *not* a
|
|
data-plane vendor token.
|
|
- Data-plane vendor credentials live only in `PROVISION_<VENDOR>_*` env secrets
|
|
consumed by the provision service, never in Terraform, never in the DB.
|
|
|
|
The full isolation register (which account/email/payment maps to which asset) is
|
|
maintained in [`../identity-isolation.md`](../identity-isolation.md).
|
|
|
|
## Usage
|
|
|
|
```bash
|
|
cd infra/terraform
|
|
cp terraform.tfvars.example terraform.tfvars # gitignored; fill in
|
|
export TF_VAR_hcloud_token=... # inject secret, never commit
|
|
|
|
terraform init
|
|
terraform fmt -check
|
|
terraform validate
|
|
terraform plan
|
|
terraform apply
|
|
```
|
|
|
|
CI/management operations run on a **dedicated channel** (doc/06 §2), not from an
|
|
operator's everyday machine.
|
|
|
|
## Layout
|
|
|
|
```
|
|
terraform/
|
|
versions.tf provider + backend pins
|
|
variables.tf root inputs
|
|
main.tf wires probe[] + control-plane modules
|
|
outputs.tf probe IPs, control-plane IP
|
|
terraform.tfvars.example
|
|
modules/
|
|
probe/ one overseas reference probe point
|
|
control-plane/ API+MySQL+Redis host (prevent_destroy)
|
|
```
|