Commit Graph

7 Commits

Author SHA1 Message Date
Maarten 594467ddf6 Add Hetzner lab guide + target configs for AWX and HAProxy
Validates full end-to-end deployment: OC + 3-node Incus cluster,
OVN overlay, HAProxy HA pair, AWX on K3s, Prometheus/Grafana stack.

New files:
- hetzner/hetzner-lab-guide.md — complete end-to-end deployment guide
- incusos/targets/hetzner/awx.yaml — AWX deploy config (hz-node-03, 10.10.0.122)
- incusos/targets/hetzner/haproxy.yaml — HAProxy deploy config (VIP 10.10.0.200)

Script fixes discovered during Hetzner deployment:
- deploy-awx: parse target_remote correctly (was reading target_node key);
  add RESUME flag support; fix target_node passthrough to incus launch;
  fix aether_url sed to not strip :8443 port
- deploy-observability: fix --remote flag (was --cluster-remote in docs),
  fix --resume to clearly skip phases 1-5 including node-exporters
- hetzner/proxmox-setup: state detection improvements from full run
- incusos-proxmox, deploy-haproxy: minor fixes from Hetzner testing

Guide covers known Aether v6.4.202 workarounds:
- HAProxy ACL bug (OVN LB DNAT-only, source IP not VIP)
- AWX cluster binding API bug (DB workaround documented)
- OVN SNAT unreliable for net-prod containers (offline install procedure)
- node-exporter manual deploy when --resume skips phase 5

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
2026-03-03 16:03:08 +01:00
Maarten 68daf96e61 Fix nag detection: check for community-scripts dpkg hook and pve-nag-buster
The previous detection only checked for void({ in proxmoxlib.js, which
is the manual sed method. The community-scripts post-install uses a
different approach: a persistent dpkg hook (/etc/apt/apt.conf.d/no-nag-script)
that calls /usr/local/bin/pve-remove-nag.sh after every package update.
That script patches data.status lines from "!== 'active'" to
"== 'NoMoreNagging'".

Now checks (in order):
1. Community-scripts hook files (no-nag-script, pve-remove-nag.sh)
2. pve-nag-buster dpkg hooks
3. void({ JS patch (manual method)
4. Nag text removed entirely

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-02 17:11:56 +01:00
Maarten 9a87261823 Fix nag detection: PVE 9 effectively disabled the subscription popup
PVE 9.1 changed the JS condition to check for 'NoMoreNagging' status
(case-sensitive compare after toLowerCase), which never matches. The
subscription API returns status "notfound" which is truthy, so the
nag dialog condition is always false. Detect PVE major version and
skip nag check for PVE >= 9.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-02 16:53:32 +01:00
Maarten a7eb09e248 Fix detection: PVE 9 deb822 repos, ZFS partition matching, WireGuard state
Tested against live aether-lab host. Fixes:

1. Repo detection: PVE 9 uses .sources (deb822) format, not .list files.
   Now checks both formats, reads Enabled: field for deb822 enterprise
   repos, and greps for pve-no-subscription across all formats.

2. Available disk detection: zpool status shows partition names
   (nvme0n1p3), not whole-disk names. Now strips partition suffix to
   get parent disk, correctly excluding system pool disks. Also detects
   existing partition tables (linux_raid_member, etc.) on available
   disks and warns about them.

3. WireGuard detection: empty output from "wg show" piped through
   "head -1" produced empty string (not "none"), which was parsed as
   active. Now explicitly checks for empty output.

4. Storage apply: detects and warns about disks with existing
   partitions, offers to wipe before ZFS pool creation. Default pool
   name changed to "vm-storage" (since "local-zfs" is the system pool).

5. Repo apply: handles both .list and .sources formats for disabling
   enterprise repos. Generates correct deb822 format for PVE 9 when
   adding no-subscription repo.

6. Fixed invalid syntax: "for f in ... 2>/dev/null; do" is not valid
   bash -- removed the redirect, file existence is checked with -f.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-02 16:46:31 +01:00
Maarten a44458ae0c Fix proxmox-setup: heredoc detection, dry_run_guard, set -e traps
Three bugs that caused the script to exit silently or behave wrong:

1. SSH detection used a double-quoted string with nested Python/awk
   containing $ and " characters that bash tried to expand locally.
   Switched to a quoted heredoc (<<'DETECT') so the entire remote
   script is passed literally.

2. dry_run_guard had return values swapped: returned 0 (success) when
   NOT in dry-run, causing apply functions to skip real work. Now
   returns 0 when DRY_RUN=true so "if dry_run_guard; then return; fi"
   correctly short-circuits.

3. Multiple "[[ test ]] && action" patterns outside if-conditions
   return 1 when the test is false, triggering set -e to abort.
   Converted all to "if [[ test ]]; then action; fi" form.

Also fixed Python any() pattern: "any(...) and print('yes')" never
prints "no" — replaced with print("yes" if any(...) else "no").

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-02 16:35:37 +01:00
Maarten 513d7cd0c6 Rewrite proxmox-setup with full state detection and status dashboard
The script now does a comprehensive single-pass detection of the host
state (repos, nag patch, packages, bridge, forwarding, NAT, storage,
WireGuard, firewall, API role/pool/token) and displays a status dashboard
showing what's done vs. what needs attention. Only pending items are
offered for configuration. Already-done steps are skipped automatically.

Partial states are handled too: e.g. bridge exists but NAT not active,
or repos switched but nag popup still present.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-02 16:22:36 +01:00
Maarten a7c856121d Add Hetzner bare metal setup guide, proxmox-setup script, and multi-target config layout
New hetzner/ directory with step-by-step Proxmox setup guide (networking,
WireGuard, firewall, storage, API tokens) and an interactive helper script
that automates all steps over SSH.

New incusos/targets/ layout with per-host connection configs and lab
definitions for beelink and hetzner targets. No changes to incusos-proxmox
itself -- uses existing --proxmox flag.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-02 15:52:57 +01:00