atlas/atlas
1
0
Fork 0
Code Issues Pull requests Actions Packages Projects Releases Wiki Activity

тестовый пиздец

Browse source
This commit is contained in:
v 2026-09-27 12:02:27 +03:00
parent 634002b7e6
commit c98dea7e27
4 changed files with 273 additions and 132 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

252
deploy.sh
View file

@ -1,81 +1,162 @@
#!/bin/bash
set -euo pipefail
# 1. Гарантируем наличие ключа в системном ssh-agent
if ! ssh-add -l >/dev/null 2>&1; then
ssh-add ~/.ssh/id_ed25519
fi
# Sovereign C2 — Unified Deployment Orchestrator (dep)
REPO_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
KDBX_PATH="$HOME/Projects/atlas-secrets.kdbx"
KDBX_PATH="${HOME}/Projects/atlas-secrets.kdbx"
RAM_CACHE="/dev/shm/.atlas_secrets_cache"
# Команда для ручной очистки RAM
if [[ "${1:-}" == "clean" ]]; then
rm -f "$RAM_CACHE"
echo "🧹 Секреты безопасно удалены из RAM."
exit 0
fi
# Цвета вывода
RED='\033[0;31m'
GREEN='\033[0;32m'
BLUE='\033[0;34m'
YELLOW='\033[1;33m'
NC='\033[0m'
# 2. Загрузка или генерация кэша в RAM (SEC-03, SEC-04)
if [[ -f "$RAM_CACHE" ]]; then
echo "⚡ Секреты загружены из RAM-кэша (/dev/shm)..."
source "$RAM_CACHE"
else
echo "🔐 Unlocking Atlas Secrets..."
log_info() { echo -e "${BLUE}==>${NC} $*"; }
log_ok() { echo -e "${GREEN}✔${NC} $*"; }
log_warn() { echo -e "${YELLOW}⚠${NC} $*"; }
log_err() { echo -e "${RED}✖${NC} $*"; }
# 1. Проверка SSH-агента и локального маршрута к 10.0.0.0/16
ensure_prerequisites() {
if ! ssh-add -l >/dev/null 2>&1; then
ssh-add ~/.ssh/id_ed25519 2>/dev/null || true
fi
if ! ip route get 10.0.10.12 2>/dev/null | grep -q "192.168.1.2"; then
log_info "Восстанавливаем локальный маршрут к 10.0.0.0/16 через VyOS (192.168.1.2)..."
sudo ip route add 10.0.0.0/16 via 192.168.1.2 2>/dev/null || true
fi
}
# 2. Безопасная загрузка секретов в RAM (SEC-03)
load_secrets_to_ram() {
if [[ -f "${RAM_CACHE}" ]]; then
source "${RAM_CACHE}"
return 0
fi
log_info "🔐 Вход в защищенный контур (KeePassXC)..."
read -s -p "Master Password: " KP_PASS
echo ""
echo "⚙️ Извлекаем секреты из KeePassXC в RAM..."
PVE_TOKEN=$(echo "$KP_PASS" | keepassxc-cli show -q -a Password "$KDBX_PATH" "ProxmoxAPI")
TF_PASS=$(echo "$KP_PASS" | keepassxc-cli show -q -a Password "$KDBX_PATH" "TofuState")
BAO_TOKEN=$(echo "$KP_PASS" | keepassxc-cli show -q -a Password "$KDBX_PATH" "OpenBaoToken")
touch "$RAM_CACHE"
chmod 600 "$RAM_CACHE"
cat <<EOF > "$RAM_CACHE"
log_info "Загрузка секретов в оперативную память (/dev/shm)..."
PVE_TOKEN=$(echo "${KP_PASS}" | keepassxc-cli show -q -a Password "${KDBX_PATH}" "ProxmoxAPI" | tr -d '\r\n ')
TF_PASS=$(echo "${KP_PASS}" | keepassxc-cli show -q -a Password "${KDBX_PATH}" "TofuState" | tr -d '\r\n ')
BAO_TOKEN=$(echo "${KP_PASS}" | keepassxc-cli show -q -a Password "${KDBX_PATH}" "OpenBaoToken" | tr -d '\r\n ')
BAO_UNSEAL=$(echo "${KP_PASS}" | keepassxc-cli show -q -a Password "${KDBX_PATH}" "OpenBaoUnseal" | tr -d '\r\n ')
unset KP_PASS
touch "${RAM_CACHE}"
chmod 600 "${RAM_CACHE}"
cat <<EOF > "${RAM_CACHE}"
export PROXMOX_VE_API_TOKEN="${PVE_TOKEN}"
export TF_VAR_proxmox_api_token="${PVE_TOKEN}"
export TF_VAR_state_passphrase="${TF_PASS}"
export PROXMOX_VE_ENDPOINT="https://192.168.1.177:8006/"
export TF_VAR_ssh_public_key="$(cat ~/.ssh/id_ed25519.pub)"
export VAULT_ADDR="http://10.0.10.12:8200"
export VAULT_TOKEN="${BAO_TOKEN}"
export VAULT_UNSEAL_KEY="${BAO_UNSEAL}"
EOF
source "$RAM_CACHE"
unset KP_PASS PVE_TOKEN TF_PASS
fi
source "${RAM_CACHE}"
unset PVE_TOKEN TF_PASS BAO_TOKEN BAO_UNSEAL
log_ok "Секреты безопасно загружены в RAM"
}
# 3. Автоматический Unseal без вопросов (строго через BAO_TOKEN)
# 3. Ансил OpenBao строго по инварианту SEC-04
unseal_vault() {
echo "🔓 Проверяем статус OpenBao Vault (${VAULT_ADDR})..."
SEAL_STATUS=$(curl -s "${VAULT_ADDR}/v1/sys/seal-status" 2>/dev/null || echo "")
if echo "${SEAL_STATUS}" | grep -q '"sealed":true'; then
echo "⚡ Vault запечатан! Выполняем авто-ансил из RAM..."
RESP=$(curl -s -X POST "${VAULT_ADDR}/v1/sys/unseal" -d "{\"key\":\"${VAULT_TOKEN}\"}")
if echo "${RESP}" | grep -q '"sealed":false'; then
echo "✅ OpenBao Vault успешно распечатан."
load_secrets_to_ram
log_info "Проверка статуса OpenBao Vault (${VAULT_ADDR})..."
local seal_status
seal_status=$(curl -s --connect-timeout 2 "${VAULT_ADDR}/v1/sys/seal-status" 2>/dev/null || echo "")
if [[ -z "${seal_status}" ]]; then
log_warn "OpenBao (${VAULT_ADDR}) недоступен по сети. Пропуск ансила."
return 0
fi
if echo "${seal_status}" | grep -q '"sealed":true'; then
log_info "OpenBao запечатан! Выполняем ансил из памяти..."
local resp
resp=$(printf '{"key":"%s"}' "${VAULT_UNSEAL_KEY}" | curl -s -X POST -H "Content-Type: application/json" --data-binary @- "${VAULT_ADDR}/v1/sys/unseal")
if echo "${resp}" | grep -q '"sealed":false'; then
log_ok "OpenBao успешно распечатан."
else
echo "❌ Ошибка при распечатывании: ${RESP}"
exit 1
log_err "Ошибка ансила OpenBao: ${resp}"
return 1
fi
else
echo "✅ OpenBao Vault уже распечатан и готов к работе."
log_ok "OpenBao уже распечатан и готов к работе."
fi
}
cd "${REPO_ROOT}/tofu"
if [[ ! -d ".terraform" ]]; then
tofu init
fi
# Послойный запуск (Layers)
up_layer() {
local layer="${1:-all}"
ensure_prerequisites
load_secrets_to_ram
# 4. Обработка команд алиаса dep
case "${1:-}" in
unseal)
unseal_vault
;;
reset)
echo "🧨 [RESET] Автоматическая зачистка Proxmox от старых хвостов..."
ssh root@192.168.1.177 bash << 'SSHEOF'
case "${layer}" in
host)
log_info "[Layer 0: PVE Host] Накатка директорий и хранилищ..."
ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/01_pve_host_day0.yml"
;;
net)
log_info "[Layer 1: VyOS & Perimeter] Накатка сетевой конфигурации..."
ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/02_vyos_network_day0.yml"
;;
tier0)
log_info "[Layer 2: Tier-0 Air-Gap] Развертывание базовых LXC сервисов..."
cd "${REPO_ROOT}/tofu" && tofu apply -target=proxmox_virtual_environment_container.dns0 \
-target=proxmox_virtual_environment_container.vault0 \
-target=proxmox_virtual_environment_container.git0 \
-target=proxmox_virtual_environment_container.storage0 \
-target=proxmox_virtual_environment_container.registry0 -auto-approve
for pb in 03_zot_registry.yml 04_technitium_dns.yml 05_openbao_vault.yml 06_forgejo_git.yml 07_nas_storage.yml; do
ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/${pb}"
done
unseal_vault
cd "${REPO_ROOT}/tofu" && tofu apply -auto-approve
;;
talos)
log_info "[Layer 3: Talos & Kubernetes] Бутстрап кластера..."
unseal_vault
cd "${REPO_ROOT}/talos" && ./bootstrap.sh
;;
apps)
log_info "[Layer 4: Workloads & GitOps] Применение Flux манифестов..."
kubectl apply -f "${REPO_ROOT}/kubernetes/bootstrap/sync.yaml"
;;
all)
log_info "Запуск полного послойного развертывания с нуля..."
up_layer host
up_layer net
up_layer tier0
up_layer talos
up_layer apps
log_ok "Вся инфраструктура полностью развернута!"
;;
*)
log_err "Неизвестный слой: ${layer}. Доступны: host, net, tier0, talos, apps, all"
exit 1
;;
esac
}
# Полный сброс до голого железа (Reset to Bare-Metal)
reset_baremetal() {
log_warn "ВНИМАНИЕ! Полная зачистка всех ВМ и LXC на Proxmox VE (192.168.1.177)."
read -r -p "Введите 'NUKE' для подтверждения полного уничтожения стейта: " confirm
if [[ "${confirm}" != "NUKE" ]]; then
echo "Отмена операции."
exit 0
fi
log_info "Уничтожение виртуальных машин и контейнеров..."
ssh root@192.168.1.177 bash << 'SSHEOF'
for id in 100 201 202 203; do
qm stop $id --skiplock 1 2>/dev/null || true
qm destroy $id --purge 1 --destroy-unreferenced-disks 1 2>/dev/null || true
@ -85,29 +166,64 @@ for id in 101 102 103 104 105; do
pct destroy $id --purge 1 --force 1 2>/dev/null || true
done
SSHEOF
echo "🧹 Очистка локального стейта..."
rm -f terraform.tfstate* .terraform.tfstate.lock.info
echo "🚀 Чистый запуск Tofu Apply с нуля..."
tofu apply -auto-approve
log_info "Очистка локального стейта OpenTofu..."
rm -f "${REPO_ROOT}/tofu/terraform.tfstate"* "${REPO_ROOT}/tofu/.terraform.tfstate.lock.info"
rm -f "${RAM_CACHE}"
log_ok "Сервер зачищен до голого железа."
}
# Точка входа
COMMAND="${1:-help}"
case "${COMMAND}" in
up)
shift
up_layer "${1:-all}"
;;
unseal)
ensure_prerequisites
unseal_vault
;;
a)
shift
unseal_vault
tofu apply -refresh=false "$@"
clean)
rm -f "${RAM_CACHE}"
log_ok "Секреты безопасно удалены из оперативной памяти."
;;
apply)
shift
unseal_vault
tofu apply "$@"
reset|nuke)
reset_baremetal
;;
state)
"${REPO_ROOT}/scripts/collect_state.sh"
;;
"")
tofu plan
plan)
ensure_prerequisites
load_secrets_to_ram
cd "${REPO_ROOT}/tofu" && tofu plan
;;
apply|a)
ensure_prerequisites
load_secrets_to_ram
unseal_vault
shift || true
cd "${REPO_ROOT}/tofu" && tofu apply "$@"
;;
help|--help|-h)
cat <<EOF
Sovereign C2 Orchestrator (dep)
Команды:
dep up [layer] Послойный деплой: host, net, tier0, talos, apps, all
dep unseal Ручной ансил OpenBao из RAM (инвариант SEC-04)
dep state Сбор глубокого снимка рантайма всех 5 уровней
dep plan Tofu plan с секретами из RAM
dep apply [args] Tofu apply с авто-ансилом
dep clean Очистка кэша секретов в /dev/shm
dep reset Полный сброс всех VM/LXC до голого PVE железа
EOF
;;
*)
tofu "$@"
ensure_prerequisites
load_secrets_to_ram
cd "${REPO_ROOT}/tofu" && tofu "$@"
;;
esac

104
docs/runtime_state.md
View file

@ -1,7 +1,7 @@
# Sovereign C2 — Снимок состояния рантайма (Runtime Snapshot)
**Дата сбора:** 2026-09-27 08:27:19 UTC
**Дата сбора:** 2026-09-27 08:30:29 UTC
**Хост:** quasar (quasar)
**Git:** master @ 7fe174e fix a
**Git:** master @ 634002b сломанный коммит
---
## 1. Гипервизор Proxmox VE (192.168.1.177)
@ -46,16 +46,16 @@ wg0 UNKNOWN 10.8.0.2/24 fe80::f8bc:2cff:fe5b:782f/64
### Соседние узлы (ARP):
```text
10.0.10.14 dev eth2 lladdr bc:24:11:04:e9:f9 STALE
10.0.10.14 dev eth2 lladdr bc:24:11:04:e9:f9 REACHABLE
192.168.1.247 dev eth0 lladdr d8:43:ae:29:3c:f3 REACHABLE
10.0.10.12 dev eth2 lladdr bc:24:11:43:98:08 STALE
192.168.1.1 dev eth0 lladdr d4:0d:ab:6c:b5:2b DELAY
10.0.20.10 dev eth1 lladdr bc:24:11:71:b6:82 REACHABLE
10.0.10.11 dev eth2 lladdr bc:24:11:93:4d:d6 STALE
10.0.20.12 dev eth1 lladdr bc:24:11:ef:1a:d4 REACHABLE
192.168.1.177 dev eth0 lladdr 70:85:c2:72:d1:1f STALE
10.0.10.15 dev eth2 lladdr bc:24:11:e0:18:d0 STALE
10.0.10.13 dev eth2 lladdr bc:24:11:89:67:96 DELAY
10.0.20.12 dev eth1 lladdr bc:24:11:ef:1a:d4 STALE
192.168.1.177 dev eth0 lladdr 70:85:c2:72:d1:1f REACHABLE
10.0.10.15 dev eth2 lladdr bc:24:11:e0:18:d0 REACHABLE
10.0.10.13 dev eth2 lladdr bc:24:11:89:67:96 REACHABLE
10.0.20.11 dev eth1 lladdr bc:24:11:12:c5:1b REACHABLE
fe80::be24:11ff:feeb:3863 dev eth3 lladdr bc:24:11:eb:38:63 STALE
fe80::be24:11ff:febb:d3 dev eth3 lladdr bc:24:11:bb:00:d3 STALE
@ -75,9 +75,9 @@ fe80::be24:11ff:feef:1ad4 dev eth1 lladdr bc:24:11:ef:1a:d4 STALE
---
## 3. Сервисы Tier-0 (Air-Gap Foundation)
* **Technitium DNS (10.0.10.11:53):** 209.85.233.101 209.85.233.100 209.85.233.138 209.85.233.113 209.85.233.139 209.85.233.102
* **Technitium DNS (10.0.10.11:53):** 209.85.233.138 209.85.233.113 209.85.233.101 209.85.233.139 209.85.233.102 209.85.233.100
* **Zot OCI Registry (10.0.10.15:5000):** HTTP 200
* **OpenBao Vault (10.0.10.12:8200):** {"initialized":true,"sealed":true,"standby":true,"performance_standby":false,"replication_performance_mode":"unknown","replication_dr_mode":"unknown","server_time_utc":1790497644,"version":"2.0.1"}
* **OpenBao Vault (10.0.10.12:8200):** {"initialized":true,"sealed":true,"standby":true,"performance_standby":false,"replication_performance_mode":"unknown","replication_dr_mode":"unknown","server_time_utc":1790497834,"version":"2.0.1"}
* **Forgejo Git (10.0.10.13:3000):** HTTP 200
### Экспорты NFS-Ganesha (10.0.10.14):
@ -106,10 +106,10 @@ NODE NAMESPACE TYPE ID VERSION HOSTNAME MACH
### Ноды кластера (Nodes):
```text
NAME STATUS ROLES AGE VERSION INTERNAL-IP EXTERNAL-IP OS-IMAGE KERNEL-VERSION CONTAINER-RUNTIME
talos-1il-vwa Ready control-plane 41m v1.37.0 10.0.20.10 <none> Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
talos-1il-vwa Ready control-plane 44m v1.37.0 10.0.20.10 <none> Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
talos-master-1 NotReady,SchedulingDisabled control-plane 7d1h v1.37.0 10.0.20.10 <none> Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
talos-pwj-620 Ready <none> 41m v1.37.0 10.0.20.11 <none> Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
talos-ts8-9xz Ready <none> 41m v1.37.0 10.0.20.12 <none> Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
talos-pwj-620 Ready <none> 44m v1.37.0 10.0.20.11 <none> Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
talos-ts8-9xz Ready <none> 44m v1.37.0 10.0.20.12 <none> Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
talos-worker-1 NotReady,SchedulingDisabled <none> 7d1h v1.37.0 10.0.20.11 <none> Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
talos-worker-2 NotReady,SchedulingDisabled <none> 7d1h v1.37.0 10.0.20.12 <none> Talos (v1.14.0) 6.18.48-talos (amd64) containerd://2.3.4
```
@ -117,86 +117,86 @@ talos-worker-2 NotReady,SchedulingDisabled <none> 7d1h v1.37.0
### Все поды (Pods):
```text
NAMESPACE NAME READY STATUS RESTARTS AGE IP NODE NOMINATED NODE READINESS GATES
cert-manager cert-manager-7894895ff6-dfk5c 1/1 Running 0 35m 10.244.4.247 talos-ts8-9xz <none> <none>
cert-manager cert-manager-7894895ff6-dfk5c 1/1 Running 0 38m 10.244.4.247 talos-ts8-9xz <none> <none>
cert-manager cert-manager-7894895ff6-gb9ct 1/1 Terminating 0 5d2h 10.244.0.203 talos-worker-2 <none> <none>
cert-manager cert-manager-cainjector-c5f96bf67-csh67 1/1 Terminating 0 5d2h 10.244.0.206 talos-worker-2 <none> <none>
cert-manager cert-manager-cainjector-c5f96bf67-v9v7r 1/1 Running 0 35m 10.244.4.58 talos-ts8-9xz <none> <none>
cert-manager cert-manager-cainjector-c5f96bf67-v9v7r 1/1 Running 0 38m 10.244.4.58 talos-ts8-9xz <none> <none>
cert-manager cert-manager-webhook-579696f8d-9ksll 1/1 Terminating 0 5d2h 10.244.0.42 talos-worker-2 <none> <none>
cert-manager cert-manager-webhook-579696f8d-9mp5l 1/1 Running 0 35m 10.244.3.64 talos-pwj-620 <none> <none>
cert-manager cert-manager-webhook-579696f8d-9mp5l 1/1 Running 0 38m 10.244.3.64 talos-pwj-620 <none> <none>
databases postgres-core-0 1/1 Terminating 0 4d16h 10.244.2.35 talos-worker-1 <none> <none>
databases redis-core-64986b88bd-hvxhp 1/1 Running 0 35m 10.244.3.137 talos-pwj-620 <none> <none>
databases redis-core-64986b88bd-hvxhp 1/1 Running 0 38m 10.244.3.137 talos-pwj-620 <none> <none>
databases redis-core-64986b88bd-rzs8j 1/1 Terminating 0 4d16h 10.244.0.28 talos-worker-2 <none> <none>
documents paperless-ngx-5b8f8d84c9-2g5sh 0/1 Pending 0 35m <none> <none> <none> <none>
documents paperless-ngx-5b8f8d84c9-2g5sh 0/1 Pending 0 39m <none> <none> <none> <none>
documents paperless-ngx-5b8f8d84c9-5hkrb 0/1 Terminating 0 3d19h 10.244.2.49 talos-worker-1 <none> <none>
external-secrets external-secrets-7ccf85c868-lj9sj 1/1 Running 0 35m 10.244.4.40 talos-ts8-9xz <none> <none>
external-secrets external-secrets-7ccf85c868-lj9sj 1/1 Running 0 39m 10.244.4.40 talos-ts8-9xz <none> <none>
external-secrets external-secrets-7ccf85c868-t8w7j 1/1 Terminating 0 5d2h 10.244.2.173 talos-worker-1 <none> <none>
external-secrets external-secrets-cert-controller-7458fdffb9-g8ps7 1/1 Running 0 35m 10.244.3.103 talos-pwj-620 <none> <none>
external-secrets external-secrets-cert-controller-7458fdffb9-g8ps7 1/1 Running 0 38m 10.244.3.103 talos-pwj-620 <none> <none>
external-secrets external-secrets-cert-controller-7458fdffb9-s8gdj 1/1 Terminating 0 5d2h 10.244.0.63 talos-worker-2 <none> <none>
external-secrets external-secrets-webhook-5b6bdfb47f-dcl56 1/1 Terminating 0 5d2h 10.244.2.84 talos-worker-1 <none> <none>
external-secrets external-secrets-webhook-5b6bdfb47f-qdc7x 1/1 Running 0 35m 10.244.3.1 talos-pwj-620 <none> <none>
external-secrets external-secrets-webhook-5b6bdfb47f-qdc7x 1/1 Running 0 39m 10.244.3.1 talos-pwj-620 <none> <none>
flux-system helm-controller-5cdd46554c-q78g8 1/1 Terminating 0 5d2h 10.244.2.97 talos-worker-1 <none> <none>
flux-system helm-controller-5cdd46554c-smm4f 1/1 Running 0 35m 10.244.4.234 talos-ts8-9xz <none> <none>
flux-system image-automation-controller-695465fc7d-kbrgd 1/1 Running 0 35m 10.244.4.86 talos-ts8-9xz <none> <none>
flux-system helm-controller-5cdd46554c-smm4f 1/1 Running 0 39m 10.244.4.234 talos-ts8-9xz <none> <none>
flux-system image-automation-controller-695465fc7d-kbrgd 1/1 Running 0 38m 10.244.4.86 talos-ts8-9xz <none> <none>
flux-system image-automation-controller-695465fc7d-mxkwz 1/1 Terminating 0 5d2h 10.244.0.189 talos-worker-2 <none> <none>
flux-system image-reflector-controller-5696cbc9b6-b4j29 1/1 Running 0 35m 10.244.3.29 talos-pwj-620 <none> <none>
flux-system image-reflector-controller-5696cbc9b6-b4j29 1/1 Running 0 39m 10.244.3.29 talos-pwj-620 <none> <none>
flux-system image-reflector-controller-5696cbc9b6-hvjk2 1/1 Terminating 0 5d2h 10.244.2.118 talos-worker-1 <none> <none>
flux-system kustomize-controller-85fb74f754-r24d4 1/1 Terminating 0 3d19h 10.244.0.115 talos-worker-2 <none> <none>
flux-system kustomize-controller-85fb74f754-zhtkw 1/1 Running 0 35m 10.244.4.216 talos-ts8-9xz <none> <none>
flux-system notification-controller-6b6889f587-8dnwn 1/1 Running 0 35m 10.244.3.124 talos-pwj-620 <none> <none>
flux-system kustomize-controller-85fb74f754-zhtkw 1/1 Running 0 38m 10.244.4.216 talos-ts8-9xz <none> <none>
flux-system notification-controller-6b6889f587-8dnwn 1/1 Running 0 38m 10.244.3.124 talos-pwj-620 <none> <none>
flux-system notification-controller-6b6889f587-g29qz 1/1 Terminating 0 5d2h 10.244.0.247 talos-worker-2 <none> <none>
flux-system source-controller-7955894b84-glmlr 1/1 Running 0 35m 10.244.3.180 talos-pwj-620 <none> <none>
flux-system source-controller-7955894b84-glmlr 1/1 Running 0 38m 10.244.3.180 talos-pwj-620 <none> <none>
flux-system source-controller-7955894b84-pfmfj 1/1 Terminating 0 5d2h 10.244.0.207 talos-worker-2 <none> <none>
flux-system source-watcher-85d5d6b5df-chjrb 1/1 Running 0 35m 10.244.3.105 talos-pwj-620 <none> <none>
flux-system source-watcher-85d5d6b5df-chjrb 1/1 Running 0 38m 10.244.3.105 talos-pwj-620 <none> <none>
flux-system source-watcher-85d5d6b5df-h2gz9 1/1 Terminating 0 5d2h 10.244.0.96 talos-worker-2 <none> <none>
infra netbox-84bc5b85d6-47z8h 0/1 Terminating 0 3d19h 10.244.0.204 talos-worker-2 <none> <none>
infra netbox-84bc5b85d6-mcnll 0/1 Pending 0 35m <none> <none> <none> <none>
kube-system cilium-82bbs 1/1 Running 0 41m 10.0.20.10 talos-1il-vwa <none> <none>
infra netbox-84bc5b85d6-mcnll 0/1 Pending 0 38m <none> <none> <none> <none>
kube-system cilium-82bbs 1/1 Running 0 44m 10.0.20.10 talos-1il-vwa <none> <none>
kube-system cilium-88dzk 1/1 Running 0 2d22h 10.0.20.11 talos-worker-1 <none> <none>
kube-system cilium-gg4hj 1/1 Running 0 2d22h 10.0.20.10 talos-master-1 <none> <none>
kube-system cilium-j98cn 1/1 Running 0 41m 10.0.20.12 talos-ts8-9xz <none> <none>
kube-system cilium-lfglr 1/1 Running 0 41m 10.0.20.11 talos-pwj-620 <none> <none>
kube-system cilium-j98cn 1/1 Running 0 44m 10.0.20.12 talos-ts8-9xz <none> <none>
kube-system cilium-lfglr 1/1 Running 0 44m 10.0.20.11 talos-pwj-620 <none> <none>
kube-system cilium-operator-7649dc899f-cl4nx 1/1 Running 0 6d23h 10.0.20.10 talos-master-1 <none> <none>
kube-system cilium-operator-7649dc899f-g5qkh 1/1 Running 0 6d23h 10.0.20.11 talos-worker-1 <none> <none>
kube-system cilium-t4mf6 1/1 Running 0 2d22h 10.0.20.12 talos-worker-2 <none> <none>
kube-system coredns-f98564579-jsrjt 1/1 Running 0 35m 10.244.3.93 talos-pwj-620 <none> <none>
kube-system coredns-f98564579-jsrjt 1/1 Running 0 38m 10.244.3.93 talos-pwj-620 <none> <none>
kube-system coredns-f98564579-knsqc 1/1 Terminating 0 7d1h 10.244.0.146 talos-worker-2 <none> <none>
kube-system coredns-f98564579-qpfxl 1/1 Terminating 0 7d1h 10.244.0.61 talos-worker-2 <none> <none>
kube-system coredns-f98564579-zjgzq 1/1 Running 0 35m 10.244.4.76 talos-ts8-9xz <none> <none>
kube-system kube-apiserver-talos-1il-vwa 1/1 Running 0 41m 10.0.20.10 talos-1il-vwa <none> <none>
kube-system kube-controller-manager-talos-1il-vwa 1/1 Running 3 (42m ago) 41m 10.0.20.10 talos-1il-vwa <none> <none>
kube-system coredns-f98564579-zjgzq 1/1 Running 0 38m 10.244.4.76 talos-ts8-9xz <none> <none>
kube-system kube-apiserver-talos-1il-vwa 1/1 Running 0 44m 10.0.20.10 talos-1il-vwa <none> <none>
kube-system kube-controller-manager-talos-1il-vwa 1/1 Running 3 (45m ago) 44m 10.0.20.10 talos-1il-vwa <none> <none>
kube-system kube-proxy-49wrb 1/1 Running 0 7d1h 10.0.20.12 talos-worker-2 <none> <none>
kube-system kube-proxy-7bbrz 1/1 Running 0 7d1h 10.0.20.11 talos-worker-1 <none> <none>
kube-system kube-proxy-fbp5n 1/1 Running 0 41m 10.0.20.11 talos-pwj-620 <none> <none>
kube-system kube-proxy-kg45g 1/1 Running 0 41m 10.0.20.10 talos-1il-vwa <none> <none>
kube-system kube-proxy-q5rql 1/1 Running 0 41m 10.0.20.12 talos-ts8-9xz <none> <none>
kube-system kube-proxy-fbp5n 1/1 Running 0 44m 10.0.20.11 talos-pwj-620 <none> <none>
kube-system kube-proxy-kg45g 1/1 Running 0 44m 10.0.20.10 talos-1il-vwa <none> <none>
kube-system kube-proxy-q5rql 1/1 Running 0 44m 10.0.20.12 talos-ts8-9xz <none> <none>
kube-system kube-proxy-zwf66 1/1 Running 0 7d1h 10.0.20.10 talos-master-1 <none> <none>
kube-system kube-scheduler-talos-1il-vwa 1/1 Running 3 (42m ago) 41m 10.0.20.10 talos-1il-vwa <none> <none>
kube-system kube-scheduler-talos-1il-vwa 1/1 Running 3 (45m ago) 44m 10.0.20.10 talos-1il-vwa <none> <none>
kube-system proxmox-csi-plugin-controller-67b678494c-8xmbs 5/5 Terminating 0 4d17h 10.244.0.208 talos-worker-2 <none> <none>
kube-system proxmox-csi-plugin-controller-67b678494c-mf45j 5/5 Running 0 35m 10.244.4.229 talos-ts8-9xz <none> <none>
kube-system proxmox-csi-plugin-controller-67b678494c-mf45j 5/5 Running 0 38m 10.244.4.229 talos-ts8-9xz <none> <none>
kube-system proxmox-csi-plugin-node-54n5v 3/3 Running 0 4d17h 10.244.0.181 talos-worker-2 <none> <none>
kube-system proxmox-csi-plugin-node-6g5bm 1/3 CrashLoopBackOff 23 (3m32s ago) 40m 10.244.4.79 talos-ts8-9xz <none> <none>
kube-system proxmox-csi-plugin-node-b6q4r 1/3 CrashLoopBackOff 23 (3m48s ago) 41m 10.244.3.101 talos-pwj-620 <none> <none>
kube-system proxmox-csi-plugin-node-6g5bm 1/3 Error 25 (2m27s ago) 43m 10.244.4.79 talos-ts8-9xz <none> <none>
kube-system proxmox-csi-plugin-node-b6q4r 1/3 Error 25 (2m35s ago) 44m 10.244.3.101 talos-pwj-620 <none> <none>
kube-system proxmox-csi-plugin-node-rqbtc 3/3 Running 0 4d17h 10.244.2.171 talos-worker-1 <none> <none>
media kiwix-reader-755bfbd9d6-lc85m 0/1 Terminating 0 3d19h <none> talos-worker-1 <none> <none>
media kiwix-reader-755bfbd9d6-sr89z 0/1 ContainerCreating 0 35m <none> talos-ts8-9xz <none> <none>
media kiwix-reader-755bfbd9d6-sr89z 0/1 ContainerCreating 0 39m <none> talos-ts8-9xz <none> <none>
media qbittorrent-595495d8dd-68lbf 0/1 Terminating 0 3d19h <none> talos-worker-2 <none> <none>
media qbittorrent-595495d8dd-djq7s 0/1 ContainerCreating 0 35m <none> talos-pwj-620 <none> <none>
security vaultwarden-6d9ffdbc96-hlscd 0/1 Pending 0 35m <none> <none> <none> <none>
media qbittorrent-595495d8dd-djq7s 0/1 ContainerCreating 0 38m <none> talos-pwj-620 <none> <none>
security vaultwarden-6d9ffdbc96-hlscd 0/1 Pending 0 39m <none> <none> <none> <none>
security vaultwarden-6d9ffdbc96-x2v29 1/1 Terminating 0 3d19h 10.244.2.19 talos-worker-1 <none> <none>
storage opencloud-78475ff485-pnlp9 0/1 Pending 0 35m <none> <none> <none> <none>
storage opencloud-78475ff485-pnlp9 0/1 Pending 0 38m <none> <none> <none> <none>
storage opencloud-78475ff485-skv5b 0/1 Terminating 938 (10h ago) 3d19h 10.244.0.248 talos-worker-2 <none> <none>
tools homebox-65757d6588-6gv9v 0/1 Terminating 941 (10h ago) 3d19h 10.244.2.110 talos-worker-1 <none> <none>
tools homebox-65757d6588-dxgjm 0/1 Pending 0 35m <none> <none> <none> <none>
tools printstash-dd7b4974d-5fz2g 0/1 ContainerCreating 0 35m <none> talos-ts8-9xz <none> <none>
tools homebox-65757d6588-dxgjm 0/1 Pending 0 39m <none> <none> <none> <none>
tools printstash-dd7b4974d-5fz2g 0/1 ContainerCreating 0 39m <none> talos-ts8-9xz <none> <none>
tools printstash-dd7b4974d-sgxq4 0/1 Terminating 0 3d19h <none> talos-worker-1 <none> <none>
tools searxng-58f98f5d4f-btbz8 1/1 Running 0 35m 10.244.3.227 talos-pwj-620 <none> <none>
tools searxng-58f98f5d4f-btbz8 1/1 Running 0 39m 10.244.3.227 talos-pwj-620 <none> <none>
tools searxng-58f98f5d4f-hg9x2 1/1 Terminating 0 3d19h 10.244.2.14 talos-worker-1 <none> <none>
tools spoolman-bccd75b46-krk4w 1/1 Terminating 0 3d19h 10.244.2.26 talos-worker-1 <none> <none>
tools spoolman-bccd75b46-nxft8 0/1 Pending 0 35m <none> <none> <none> <none>
tools spoolman-bccd75b46-nxft8 0/1 Pending 0 39m <none> <none> <none> <none>
tools sure-finance-55dfc4fcbc-gq62p 0/1 Terminating 904 (10h ago) 3d19h 10.244.2.46 talos-worker-1 <none> <none>
tools sure-finance-55dfc4fcbc-v88xj 0/1 CrashLoopBackOff 11 (2m34s ago) 35m 10.244.3.170 talos-pwj-620 <none> <none>
tools sure-finance-55dfc4fcbc-v88xj 0/1 Error 12 (5m43s ago) 39m 10.244.3.170 talos-pwj-620 <none> <none>
traefik traefik-5896ddc6fd-6jt6x 1/1 Terminating 0 5d2h 10.244.2.228 talos-worker-1 <none> <none>
traefik traefik-5896ddc6fd-zhqj6 1/1 Running 0 35m 10.244.4.251 talos-ts8-9xz <none> <none>
traefik traefik-5896ddc6fd-zhqj6 1/1 Running 0 39m 10.244.4.251 talos-ts8-9xz <none> <none>
```
### L2-политики Cilium:

43
tofu/secrets.tf
View file

@ -1,29 +1,48 @@
# Генерация случайного пароля для базы Sure
resource "random_password" "sure_db_password" {
length = 32
special = false
# 1. Декларативный KV-v2 движок
resource "vault_mount" "secret" {
path = "secret"
type = "kv-v2"
description = "Primary KV v2 secrets store"
}
# Публикация секрета в KV v2 OpenBao
resource "vault_kv_secret_v2" "sure" {
mount = "secret"
name = "sure"
# 2. Секрет для Proxmox CSI (разблокирует PVC тома)
locals {
pve_token_parts = split("=", var.proxmox_api_token)
}
resource "vault_kv_secret_v2" "proxmox_csi" {
mount = vault_mount.secret.path
name = "proxmox-csi"
data_json = jsonencode({
DB_PASSWORD = random_password.sure_db_password.result
token_id = local.pve_token_parts[0]
token_secret = local.pve_token_parts[1]
})
}
# Генерация пароля для суперпользователя Postgres
# 3. База данных Postgres Core
resource "random_password" "postgres_password" {
length = 32
special = false
}
# Запись пароля в OpenBao
resource "vault_kv_secret_v2" "postgres" {
mount = "secret"
mount = vault_mount.secret.path
name = "postgres"
data_json = jsonencode({
POSTGRES_PASSWORD = random_password.postgres_password.result
})
}
# 4. База данных Sure Finance
resource "random_password" "sure_db_password" {
length = 32
special = false
}
resource "vault_kv_secret_v2" "sure" {
mount = vault_mount.secret.path
name = "sure"
data_json = jsonencode({
DB_PASSWORD = random_password.sure_db_password.result
})
}

6
tofu/variables.tf
View file

@ -1,4 +1,10 @@
variable "ssh_public_key" {
type = string
description = "Публичный SSH-ключ для доступа к ВМ и LXC"
}
variable "proxmox_api_token" {
type = string
description = "Proxmox API Token формата USER@REALM!TOKENID=UUID"
sensitive = true
}