maarten
/
incus-contrib
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Add per-environment config files and split env secrets 

- Create envs/beelink/env and envs/hetzner/env (gitignored, from root env)
- Create beelink awx.yaml, haproxy.yaml, observability.yaml (extracted
  from deploy script hardcoded defaults)
- Create hetzner observability.yaml
- Rewrite envs/README.md for new structure
- Update usage comments in all YAML files for new paths

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Maarten 2026-03-03 18:40:42 +01:00
parent b72b7a8ca2
commit 6ed083fd51
10 changed files with 157 additions and 63 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

94
envs/README.md
View File

@ -1,76 +1,72 @@
# Target Configurations
# Environment Configurations
Target-specific Proxmox connection configs and lab definitions. Each
subdirectory represents a physical host (or host type) with its own
network topology, storage backend, and resource sizing.
## How it works
`incusos-proxmox` already supports `--proxmox FILE` to point at any
connection config. Targets are just an organizational convention --
no script changes required.
Per-environment connection configs, secrets, and deployment settings. Each
subdirectory represents a physical host (or host type) with its own network
topology, storage backend, and resource sizing.
## Directory layout
```
targets/
envs/
├── beelink/
│ ├── proxmox.yaml.example # Connection template (LAN, vmbr0, local-lvm)
│ └── lab-cluster.yaml # 3-node cluster sized for beelink (4C/4G/50G)
│ ├── env # Secrets: PROXMOX_TOKEN_SECRET, etc. (gitignored)
│ ├── proxmox.yaml # Proxmox connection (gitignored)
│ ├── proxmox.yaml.example # Connection template (LAN, vmbr0, local-lvm)
│ ├── lab-cluster.yaml # 3-node cluster (4C/4G/50G)
│ ├── awx.yaml # AWX deployment settings
│ ├── haproxy.yaml # HAProxy deployment settings
│ └── observability.yaml # Monitoring stack settings
└── hetzner/
├── proxmox.yaml.example # Connection template (WireGuard, vmbr1, local-zfs)
├── lab-cluster.yaml # 3-node cluster sized for hetzner (8C/16G/100G)
└── lab-production.yaml # OC + 3-node cluster for hetzner
├── env # Secrets (gitignored)
├── proxmox.yaml # Proxmox connection (gitignored)
├── proxmox.yaml.example # Connection template (WireGuard, vmbr1, local-zfs)
├── lab-cluster.yaml # 3-node cluster (8C/16G/100G)
├── lab-production.yaml # OC + 3-node cluster
├── awx.yaml # AWX deployment settings
├── haproxy.yaml # HAProxy deployment settings
├── observability.yaml # Monitoring stack settings
└── setup/ # Host provisioning (Proxmox install guide + script)
├── README.md
├── hetzner-setup.md
├── hetzner-lab-guide.md
└── proxmox-setup
```
## Usage
## How to use
### 1. Copy the example and fill in credentials
### 1. Source the environment
Each environment has its own `env` file with the same variable names.
Source the one for the host you're targeting:
```bash
cp incusos/targets/hetzner/proxmox.yaml.example incusos/targets/hetzner/proxmox.yaml
# Edit with your API token, host IP, etc.
source envs/beelink/env # or: source envs/hetzner/env
```
### 2. Deploy with explicit --proxmox
### 2. Deploy VMs
```bash
incusos-proxmox --proxmox incusos/targets/hetzner/proxmox.yaml \
incusos/targets/hetzner/lab-cluster.yaml
bin/incusos-proxmox --proxmox envs/hetzner/proxmox.yaml \
envs/hetzner/lab-production.yaml
```
### 3. Or symlink for convenience
### 3. Deploy services with --config
```bash
# Point the auto-discovered proxmox.yaml at your active target
ln -sf targets/hetzner/proxmox.yaml incusos/proxmox.yaml
# Now deploy without --proxmox
incusos-proxmox incusos/targets/hetzner/lab-cluster.yaml
bin/deploy-awx --config envs/hetzner/awx.yaml --deploy
bin/deploy-haproxy --config envs/hetzner/haproxy.yaml --deploy
bin/deploy-observability --config envs/hetzner/observability.yaml --deploy
```
## Environment variables
## Adding a new environment
`incusos-proxmox` reads `PROXMOX_TOKEN_SECRET` from the environment (or
the `env` file at the repo root). When working with multiple targets,
use different variable names per host:
1. Create a new subdirectory: `envs/myhost/`
2. Copy `proxmox.yaml.example` from an existing env and edit
3. Create an `env` file with your secrets (same variable names)
4. Create lab YAML files sized for your hardware
5. Create `awx.yaml`, `haproxy.yaml`, `observability.yaml` with your IPs
```bash
# In env file
PROXMOX_TOKEN_SECRET=beelink-token-here
HETZNER_PROXMOX_TOKEN_SECRET=hetzner-token-here
```
Before deploying to a specific target, export the right secret:
```bash
# Deploy to Hetzner
export PROXMOX_TOKEN_SECRET="$HETZNER_PROXMOX_TOKEN_SECRET"
incusos-proxmox --proxmox incusos/targets/hetzner/proxmox.yaml \
incusos/targets/hetzner/lab-cluster.yaml
```
## Key differences between targets
## Key differences between environments
| Setting | Beelink | Hetzner |
|---------|---------|---------|

26
envs/beelink/awx.yaml Normal file
View File

@ -0,0 +1,26 @@
# awx.yaml - AWX deployment config for Beelink lab
#
# Deploys a Debian 12 VM with K3s + AWX Operator on oc-node-02.
# VM uses the flat VLAN 69 network for direct access.
#
# Architecture:
# awx (192.168.102.161) - K3s + AWX Operator + AWX instance
# AWX exposed on NodePort 30080 (HTTP)
#
# Usage:
# source envs/beelink/env
# bin/deploy-awx --config envs/beelink/awx.yaml --deploy
awx:
vm_name: awx
target_remote: oc-node-02
ip: 192.168.102.161/22
gateway: 192.168.100.1
dns: 192.168.100.1
cpu: 4
memory: 8GiB
disk: 40GiB
git_repo: ssh://git@192.168.1.200:2222/maarten/incus-contrib.git
git_branch: master
aether_url: https://192.168.102.160:8443
aether_cluster_id: 52

26
envs/beelink/haproxy.yaml Normal file
View File

@ -0,0 +1,26 @@
# haproxy.yaml - HAProxy load balancing config for Beelink lab
#
# Deploys 2 HAProxy containers on the OVN overlay (net-prod, 10.10.10.0/24)
# with a VIP on the UPLINK external range (192.168.103.200).
#
# Architecture:
# ffsdn-haproxy-52-01 (10.10.10.50) - HAProxy instance 1 on net-prod
# ffsdn-haproxy-52-02 (10.10.10.51) - HAProxy instance 2 on net-prod
# nginx-lb-01/02/03 (10.10.10.60-62) - nginx test backends on net-prod
# VIP: 192.168.103.200:80 - OVN LB for external access
#
# Usage:
# source envs/beelink/env
# bin/deploy-haproxy --config envs/beelink/haproxy.yaml --deploy
haproxy:
cluster_remote: oc-node-01
cluster_id: 52
ovn_network: net-prod
vip: 192.168.103.200
haproxy_01_ip: 10.10.10.50
haproxy_02_ip: 10.10.10.51
backend_ips: 10.10.10.60,10.10.10.61,10.10.10.62
service_name: web-test
image_version: "1.0.0"
aether_url: https://192.168.102.160:8443

4
envs/beelink/lab-cluster.yaml
View File

@ -4,8 +4,8 @@
# Deploys 3 standalone Incus nodes that can be clustered after deployment.
#
# Usage:
# incusos-proxmox --proxmox incusos/targets/beelink/proxmox.yaml \
# incusos/targets/beelink/lab-cluster.yaml
# bin/incusos-proxmox --proxmox envs/beelink/proxmox.yaml \
# envs/beelink/lab-cluster.yaml
#
# Connection settings from proxmox.yaml in this directory.

25
envs/beelink/observability.yaml Normal file
View File

@ -0,0 +1,25 @@
# observability.yaml - Monitoring stack config for Beelink lab
#
# Deploys Prometheus, Grafana, Loki, and Promtail in a monitoring container,
# plus node-exporter containers on each cluster node.
#
# Architecture:
# monitoring (10.10.10.70) - Prometheus + Grafana + Loki
# node-exp-01/02/03 - node-exporter on each cluster node
# Forward VIP: 192.168.103.201 - OVN LB for external access
#
# Usage:
# source envs/beelink/env
# bin/deploy-observability --config envs/beelink/observability.yaml --deploy
observability:
cluster_remote: oc-node-01
ovn_network: net-prod
monitoring_ip: 10.10.10.70
monitoring_target: oc-node-02
forward_vip: 192.168.103.201
incus_nodes: 192.168.102.140,192.168.102.141,192.168.102.142
node_exp_targets: oc-node-01,oc-node-02,oc-node-03
node_exp_ips: 10.10.10.71,10.10.10.72,10.10.10.73
haproxy_ips: 10.10.10.50,10.10.10.51
haproxy_cluster_id: 52

6
envs/hetzner/awx.yaml
View File

@ -8,10 +8,8 @@
# AWX exposed on NodePort 30080 (HTTP)
#
# Usage:
# source env
# ./incusos/deploy-awx \
# --config incusos/targets/hetzner/awx.yaml \
# --deploy
# source envs/hetzner/env
# bin/deploy-awx --config envs/hetzner/awx.yaml --deploy
awx:
vm_name: awx

6
envs/hetzner/haproxy.yaml
View File

@ -10,10 +10,8 @@
# VIP: 10.10.0.200:80 - OVN external IP for external access
#
# Usage:
# source env
# ./incusos/deploy-haproxy \
# --config incusos/targets/hetzner/haproxy.yaml \
# --deploy
# source envs/hetzner/env
# bin/deploy-haproxy --config envs/hetzner/haproxy.yaml --deploy
haproxy:
cluster_remote: hz-cluster

4
envs/hetzner/lab-cluster.yaml
View File

@ -7,8 +7,8 @@
# VMs get static IPs in the 10.10.0.101-103 range.
#
# Usage:
# incusos-proxmox --proxmox incusos/targets/hetzner/proxmox.yaml \
# incusos/targets/hetzner/lab-cluster.yaml
# bin/incusos-proxmox --proxmox envs/hetzner/proxmox.yaml \
# envs/hetzner/lab-cluster.yaml
#
# Connection settings from proxmox.yaml in this directory.

4
envs/hetzner/lab-production.yaml
View File

@ -15,8 +15,8 @@
# RAM budget: ~248 GiB of 256 GiB (8 GiB OC + 3×80 GiB nodes; ~8 GiB reserved for Proxmox host)
#
# Usage:
# incusos-proxmox --proxmox incusos/targets/hetzner/proxmox.yaml \
# incusos/targets/hetzner/lab-production.yaml
# bin/incusos-proxmox --proxmox envs/hetzner/proxmox.yaml \
# envs/hetzner/lab-production.yaml
#
# After deployment, follow notes/production-lab-guide.md for:
# - Cluster formation (section 4)

25
envs/hetzner/observability.yaml Normal file
View File

@ -0,0 +1,25 @@
# observability.yaml - Monitoring stack config for Hetzner lab
#
# Deploys Prometheus, Grafana, Loki, and Promtail in a monitoring container,
# plus node-exporter containers on each cluster node.
#
# Architecture:
# monitoring (10.10.10.70) - Prometheus + Grafana + Loki
# node-exp-01/02/03 - node-exporter on each cluster node
# Forward VIP: 10.10.0.201 - OVN LB for external access
#
# Usage:
# source envs/hetzner/env
# bin/deploy-observability --config envs/hetzner/observability.yaml --deploy
observability:
cluster_remote: hz-cluster
ovn_network: net-prod
monitoring_ip: 10.10.10.70
monitoring_target: hz-node-02
forward_vip: 10.10.0.201
incus_nodes: 10.10.0.111,10.10.0.112,10.10.0.113
node_exp_targets: hz-node-01,hz-node-02,hz-node-03
node_exp_ips: 10.10.10.71,10.10.10.72,10.10.10.73
haproxy_ips: 10.10.10.50,10.10.10.51
haproxy_cluster_id: 52