#!/usr/bin/env bash
# scripts/dc-rack-net.sh <check|install> <site> -- DC rack network persistence:
# rack bridge legs + the node-facing DNS forwarder (D-131 sub-1, RULED
# 2026-07-21: the forwarder is the STANDING per-DC pattern; this script is its
# repo-carried delivery, folding in rack-legs persistence per D-128 register
# item 20).
#
# RUNS ON THE DC RACK HOST (e.g. vvr1-dc0), not on vcloud/voffice1. Invoke
# from a repo host over ssh, piping the script (no repo clone needed there):
#
# check: ssh -i <dc0-key> -J voffice1 <user>@172.31.0.2 \
# 'sudo bash -s' -- check dc0 < scripts/dc-rack-net.sh
# install: same with 'install dc0' (idempotent; safe to re-run).
#
# WHAT IT OWNS (site-keyed table below; every value MEASURED, never inferred):
# 1. <site>-rack-legs.service -- oneshot, After=libvirtd: re-adds the rack's
# bridge IP legs on every boot. WHY: these addresses were added with bare
# `ip addr` at standup (2026-07-20/21 session changelogs) and are DROPPED
# on reboot -- same failure class as the D-126 office1 base leg. The rack's
# MAAS DHCP (metal-admin leg) and edge-LAN reach (provider-public leg)
# silently die with them.
# 2. <site>-node-dns.service + /etc/dnsmasq-<site>-node.conf -- the D-131
# forwarder: dnsmasq on a metal-admin alias, no-resolv, forwarding to the
# region's authoritative BIND over the rack's own transit connection
# (OUTPUT traffic only -- the SEC-010 FORWARD-drop is untouched). WHY: the
# MAAS 3.7 rack-only agent resolver SERVFAILs ALL queries on an
# internet-isolated rack, including its own authoritative maas-internal
# zone (walks public root hints, ignores resolv.conf; LP report queued),
# so commissioning cloud-config-url never resolves. Full chain:
# docs/audit/commissioning-diag-20260721.txt.
# 3. /usr/local/sbin/<site>-rack-net-apply -- the boot-time helper both units
# use. It resolves bridge devices FROM LIBVIRT NETWORK NAMES at runtime
# (virsh net-dumpxml): the virbrN names are libvirt AUTO-ASSIGNED and
# would drift if a plane network were ever recreated -- a network NAME is
# the stable identity, a virbrN literal is exactly the drifting-ID class
# hard rule 3 forbids. No virbr literal appears in this file.
#
# REGION-SIDE COMPANION (runbook step, NOT this script -- same split as
# site-headend-install.sh's DHCP note): the MAAS metal-admin subnet must carry
# dns_servers=<forwarder addr> + allow_dns=false (applied + proven 2026-07-21).
#
# EXIT: 0 ok | 1 check failed | 2 bad args/unknown site | 4 install failed.
# ASCII + LF only.
set -uo pipefail
MODE="${1:-}"; SITE="${2:-}"
case "$MODE" in check|install) ;; *)
echo "usage: dc-rack-net.sh <check|install> <site>" >&2; exit 2 ;; esac
# ---------------------------------------------------------------------------
# Site table. ADD A SITE ONLY WITH MEASURED VALUES (hard rule 2): every leg row
# cites where its value was measured. The harness rejects rows without a
# MEASURED tag.
# ---------------------------------------------------------------------------
case "$SITE" in
dc0)
# MEASURED 2026-07-21 on vvr1-dc0 (ip -4 -o addr / virsh net-list; session
# changelog 2026-07-21 + adjudication commissioning-diag-20260721.txt):
# vr1-dc0-metal-admin 10.12.8.2/22 rack MAAS/DHCP leg
# vr1-dc0-metal-admin 10.12.8.3/22 node-DNS forwarder listen alias
# vr1-dc0-provider-public 10.12.4.2/22 edge-LAN leg (edge gw 10.12.4.1)
LEGS="vr1-dc0-metal-admin=10.12.8.2/22
vr1-dc0-metal-admin=10.12.8.3/22
vr1-dc0-provider-public=10.12.4.2/22"
DNS_LISTEN="10.12.8.3" # MEASURED: live forwarder listen address
DNS_UPSTREAM="10.10.0.20" # MEASURED: region BIND (voffice1) over transit
;;
*) echo "FAIL: unknown site '$SITE' -- add a MEASURED row block first" >&2; exit 2 ;;
esac
HELPER="/usr/local/sbin/${SITE}-rack-net-apply"
LEGS_UNIT="/etc/systemd/system/${SITE}-rack-legs.service"
DNS_CONF="/etc/dnsmasq-${SITE}-node.conf"
DNS_UNIT="/etc/systemd/system/${SITE}-node-dns.service"
# ---------------------------------------------------------------------------
# Generated file contents (single source of truth for check AND install).
# ---------------------------------------------------------------------------
gen_helper() {
cat <<EOF
#!/usr/bin/env bash
# ${SITE}-rack-net-apply -- generated by scripts/dc-rack-net.sh; do not hand-edit.
# Re-adds the rack bridge legs. Bridge devices are resolved from libvirt
# NETWORK NAMES at runtime (virbrN is auto-assigned and not stable identity).
set -euo pipefail
br_of() {
virsh -c qemu:///system net-dumpxml "\$1" | sed -n "s/.*bridge name='\\([^']*\\)'.*/\\1/p"
}
apply_legs() {
$(echo "$LEGS" | while IFS='=' read -r net cidr; do
printf ' ip addr replace %s dev "$(br_of %s)"\n' "$cidr" "$net"; done)
}
apply_legs
EOF
}
gen_legs_unit() {
cat <<EOF
[Unit]
Description=${SITE} rack bridge IP legs (dc-rack-net.sh; D-128 item 20 -- re-add on boot)
After=libvirtd.service network-online.target
Wants=network-online.target
[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=${HELPER}
[Install]
WantedBy=multi-user.target
EOF
}
gen_dns_conf() {
cat <<EOF
# ${SITE} node-facing DNS forwarder (D-131 sub-1 STANDING pattern; generated by
# scripts/dc-rack-net.sh -- do not hand-edit).
# Why: MAAS 3.7 rack-only agent resolver SERVFAILs authoritative maas-internal
# queries on an internet-isolated rack (walks root hints; LP report queued).
# Nodes need maas-internal names for cloud-init's cloud-config-url.
# Listens on a metal-admin alias and forwards to the region's authoritative
# BIND over the rack's own transit connection (OUTPUT traffic -- the SEC-010
# FORWARD-drop is untouched).
listen-address=${DNS_LISTEN}
bind-interfaces
port=53
no-resolv
no-hosts
server=${DNS_UPSTREAM}
cache-size=500
EOF
}
gen_dns_unit() {
cat <<EOF
[Unit]
Description=${SITE} node-facing DNS forwarder (D-131; MAAS 3.7 rack-resolver workaround)
After=${SITE}-rack-legs.service
Requires=${SITE}-rack-legs.service
[Service]
Type=simple
ExecStart=/usr/sbin/dnsmasq -k -C ${DNS_CONF}
Restart=on-failure
RestartSec=5
[Install]
WantedBy=multi-user.target
EOF
}
# ---------------------------------------------------------------------------
# check -- mutate NOTHING; report and exit 0 ok / 1 incomplete.
# ---------------------------------------------------------------------------
FAILED=0
say(){ echo " $1"; }
miss(){ echo " MISS $1"; FAILED=1; }
check_file() { # path gen_fn
if [ ! -f "$1" ]; then miss "$1 absent"; return; fi
if diff -q <("$2") "$1" >/dev/null 2>&1; then say "OK $1 matches"; else
miss "$1 DIFFERS from generated content"; fi
}
do_check() {
check_file "$HELPER" gen_helper
check_file "$LEGS_UNIT" gen_legs_unit
check_file "$DNS_CONF" gen_dns_conf
check_file "$DNS_UNIT" gen_dns_unit
for u in "${SITE}-rack-legs" "${SITE}-node-dns"; do
[ "$(systemctl is-enabled "$u" 2>/dev/null)" = "enabled" ] \
&& say "OK $u enabled" || miss "$u not enabled"
done
systemctl is-active --quiet "${SITE}-node-dns" \
&& say "OK ${SITE}-node-dns active" || miss "${SITE}-node-dns not active"
echo "$LEGS" | while IFS='=' read -r net cidr; do
br="$(virsh -c qemu:///system net-dumpxml "$net" 2>/dev/null \
| sed -n "s/.*bridge name='\([^']*\)'.*/\1/p")"
if [ -z "$br" ]; then echo " MISS libvirt net $net unresolvable"; exit 1; fi
ip -4 -o addr show dev "$br" 2>/dev/null | grep -q " ${cidr%%/*}/" \
&& echo " OK $cidr on $br ($net)" \
|| { echo " MISS $cidr absent on $br ($net)"; exit 1; }
done || FAILED=1
[ "$FAILED" -eq 0 ] && { echo "dc-rack-net check ($SITE): PASS"; exit 0; }
echo "dc-rack-net check ($SITE): FAIL"; exit 1
}
# ---------------------------------------------------------------------------
# install -- idempotent; requires root.
# ---------------------------------------------------------------------------
do_install() {
[ "$(id -u)" = "0" ] || { echo "FAIL: install requires root" >&2; exit 4; }
command -v dnsmasq >/dev/null 2>&1 || { echo "FAIL: dnsmasq not installed" >&2; exit 4; }
umask 022
gen_helper > "$HELPER" && chmod 755 "$HELPER" || exit 4
gen_legs_unit > "$LEGS_UNIT" || exit 4
gen_dns_conf > "$DNS_CONF" || exit 4
gen_dns_unit > "$DNS_UNIT" || exit 4
systemctl daemon-reload || exit 4
systemctl enable --now "${SITE}-rack-legs.service" >/dev/null 2>&1 || exit 4
systemctl enable "${SITE}-node-dns.service" >/dev/null 2>&1 || exit 4
systemctl restart "${SITE}-node-dns.service" || exit 4
echo "dc-rack-net install ($SITE): done -- running check:"
do_check
}
case "$MODE" in
check) do_check ;;
install) do_install ;;
esac
