# Aether — Management Platform for Incus + OVN

Aether is a web-based management application that connects to Incus clusters
and Operations Center instances. It provides VM/container deployment via
blueprints, OVN network management, NSX firewall rule translation to OVN ACLs,
HAProxy load balancer management, Ansible automation, and RBAC.

## Deployment

### Requirements

- **Image**: Ubuntu Noble (24.04) golden image (~6.6 GiB compressed, 200 GiB
  virtual disk)
- **Resources**: 8 GiB RAM minimum
- **Networking**: needs direct LAN/VLAN access (macvlan recommended)
- **Services**: PostgreSQL (bundled), FFSDN Go application on port 8443

### Deployment on Incus cluster

```bash
# Import image
incus image import sources/aether-golden-image-v6.tar.gz \
    --alias aether-golden-image-v6 <remote>:

# Create VM (200 GiB disk required — qcow2 virtual size)
incus init <remote>:aether-golden-image-v6 <remote>:aether --vm \
    --target <node> --config limits.memory=8GiB -d root,size=200GiB

# Configure macvlan networking for direct VLAN access
incus config device remove <remote>:aether eth0 2>/dev/null
incus config device add <remote>:aether eth0 nic nictype=macvlan parent=mgmt

# Start and wait ~30s for boot
incus start <remote>:aether

# Run post-deploy (configures static IP, regenerates SSH keys, sets up DB)
incus exec <remote>:aether -- /home/ffsdn/post_deploy.sh <IP/PREFIX> <GATEWAY> <DNS>
```

### Disk size considerations

The golden image is a qcow2 with 200 GiB virtual size but only ~11 GiB actual
data. The target node must have at least 200 GiB of allocatable storage (even
if thin-provisioned). On a fresh IncusOS node with a 64 GiB disk, only ~29 GiB
is free after the OS. Nodes with 50 GiB disks (~8.5 GiB free) cannot host
Aether. Target the node with the most available storage.

### Lab deployment details

| Setting | Value |
|---------|-------|
| VM name | `aether` |
| Location | oc-node-01 |
| IP | 192.168.102.160/22 (VLAN 69) |
| Gateway | 192.168.100.1 |
| DNS | 192.168.100.1 |
| Port | 8443 (HTTPS) |
| RAM | 8 GiB |
| Disk | 200 GiB (virtual), ~11 GiB actual |

### Web UI

Access at `https://<IP>:8443`. Default credentials: admin / (set during setup).

### Post-deploy script

`/home/ffsdn/post_deploy.sh` performs 7 steps:
1. Configure network (netplan)
2. Apply network configuration
3. Regenerate SSH host keys
4. Wait for FFSDN to create PostgreSQL user
5. Transfer database ownership
6. Transfer table and sequence ownership
7. Restart FFSDN service

The script **deletes itself** after successful execution.

## Navigation

The sidebar provides access to all features:

| Menu Item | URL Path | Description |
|-----------|----------|-------------|
| Home | `/home` | Dashboard, welcome page |
| Manage Global FW rules | `/global-acls` | Global firewall / ACL management |
| Manage Cluster FW rules | (submenu) | Per-cluster firewall rules |
| Manage RBAC | (submenu) | Role-based access control |
| Manage VMs/Containers | `/infra` | View and manage instances |
| Deploy VM/Container/Blueprint | `/deploy` | Launch new workloads |
| Deployed Blueprints | `/deployedblueprints` | Track blueprint deployments |
| Blueprint Design | `/blueprintdesign` | Create deployment templates |
| Ansible Automation | `/awx-endpoints` | Ansible playbook management |
| Manage INCUS Clusters | `/incus-infra` | Connect and manage Incus clusters |
| Operations Center | `/operationcenter` | Connect to OC instances |
| HAProxy Load Balancers | `/haproxy` | Load balancer configuration |
| Trace Network Flow | `/traceflow` | Network flow analysis (NSX → OVN ACL translation?) |
| View Live GO Log | `/logs/live` | Real-time application logs |
| AETHER Ledger | `/logs` | Audit/activity ledger |
| View Sync Logs | `/synclogs` | Synchronization logs |
| AETHER Health | `/health` | System health checks |
| Change Password | `/change-password` | Change admin password |
| Licensing | `/licensing` | License management |
| Settings | `/settings` | Application settings |

## Initial Setup

### Step 1: Connect Incus Cluster

Navigate to **Manage INCUS Clusters** (`/incus-infra`) → click
**Add/Edit/Delete INCUS clusters from/to AETHER**.

The form requires:
- **Cluster Name**: label for this cluster (e.g., `oc-lab-cluster`)
- **URL**: Incus API endpoint (e.g., `https://192.168.102.141:8443`)
- **Trust Token**: generated on the cluster

Generate a trust token on the Incus cluster:
```bash
incus config trust add <remote>:AETHER
```

Paste the token into the form and click **Add Cluster**. The cluster appears
in the "Current INCUS Clusters" table with its TLS certificate fingerprint
and expiry date.

After adding, select the cluster from the **Select Cluster** dropdown on
the INCUS Infrastructure Management page. This loads the cluster dashboard
with tabs:

| Tab | Description |
|-----|-------------|
| Clustering: Members | Cluster nodes with status, memory, load, roles |
| Clustering: Cluster Groups | Logical groupings of nodes |
| Storage: Pools | Storage pool configuration |
| Storage: Volumes | Storage volume management |
| Profiles | Instance profiles with devices and config |
| Operations | Running and completed operations |
| Warnings | Cluster warnings |
| Settings | Cluster configuration |
| Images | Cached images across the cluster |
| Configuration | Cluster-level config keys |
| Instances | All instances with actions (Start/Stop/Migrate/Console/etc.) |
| Networking | Networks (bridge, OVN, physical) with View/Edit |
| ACLs | Network ACL management |
| Address Sets | Address set management for ACLs |
| OS | IncusOS node management |

The **Instances** tab provides per-instance action buttons: Start, Restart,
Freeze, Unfreeze, Stop, Migrate, Snapshot, Console, Logs, Delete. Instances
can be filtered by type (VM/Container) and status. Each row shows name, type,
status, IPv4, memory usage, image, snapshots, and location (cluster member).

The **Cluster Members** view shows real-time memory and load bars per node,
OVN roles, and an Evacuate action button.

### Step 2: Connect Operations Center

Navigate to **Operations Center** (`/operationcenter`) → click
**+ Add Operations Center**.

The form requires:
- **Name**: label for this OC (e.g., `oc-lab`)
- **URL**: OC API endpoint (e.g., `https://192.168.102.120:8443`)
- **Certificate (PEM)**: client TLS certificate (PEM format)
- **Private Key (PEM)**: matching private key (PEM format)

Unlike Incus (which uses trust tokens), OC uses **mutual TLS** — Aether
connects with a client certificate that must already be in the OC trust store.
Use the same `client.crt` and `client.key` that were injected into the OC
seed during deployment (typically at `~/.config/incus/client.crt` and
`~/.config/incus/client.key`).

Click **Test Connection** to verify — a successful test shows:
`Connected! API: 1.0 (devel)`.

Click **Save** to add the OC. The OC appears in the "Configured Operations
Centers" table with status, fingerprint, last connected timestamp, and
Edit/Test/Delete actions. A green **Manage** badge indicates an active
connection.

### Connection comparison

| | Incus Cluster | Operations Center |
|---|---|---|
| Auth method | Trust token | Mutual TLS (client cert + key) |
| Token/cert source | `incus config trust add` | Existing client cert from `~/.config/incus/` |
| API version | Incus REST API | OC API 1.0 |
| Port | 8443 | 8443 |

## Lab State After Setup

### Connected infrastructure

| Connection | Name | URL | Status |
|------------|------|-----|--------|
| Incus Cluster | oc-lab-cluster | https://192.168.102.141:8443 | Connected |
| Operations Center | oc-lab | https://192.168.102.120:8443 | Connected |

### Cluster members (as seen in Aether)

| Node | URL | Status | Memory | Load | Roles |
|------|-----|--------|--------|------|-------|
| oc-node-01 | https://192.168.102.140:8443 | Online | 35% (5.5/16.0 GB) | 19% | ovn-chassis, database |
| oc-node-02 | https://192.168.102.141:8443 | Online | 92% (14.7/16.0 GB) | 28% | ovn-chassis, database-leader |
| oc-node-03 | https://192.168.102.142:8443 | Online | 54% (8.7/16.0 GB) | 25% | ovn-chassis, database |

### Instances visible in Aether

| Name | Type | Status | IPv4 | Image | Location |
|------|------|--------|------|-------|----------|
| aether | VM | Running | 192.168.102.160 | ubuntu noble | oc-node-01 |
| ovn-central | Container | Running | 10.207.217.23 | Debian bookworm | oc-node-02 |
| ha-web-02 | Container | Stopped | 10.10.10.3 | Debian bookworm | oc-node-02 |
| ha-web-03 | Container | Stopped | 10.10.10.4 | Debian bookworm | oc-node-03 |

### Networks visible in Aether

| Name | Type | IPv4 | Uplink | NAT | Used By |
|------|------|------|--------|-----|---------|
| UPLINK | physical | 192.168.100.1/22 | - | - | 1 |
| incusbr0 | bridge | 10.207.217.1/24 | - | IPv4, IPv6 | 2 |
| meshbr0 | bridge | none | - | IPv6 | 1 |
| net-prod | ovn | 10.10.10.1/24 | UPLINK | IPv4, IPv6 | 2 |