diff --git a/docs/changelog-20260806-step34-g3-probe.md b/docs/changelog-20260806-step34-g3-probe.md index 72f77f8..950bf02 100644 --- a/docs/changelog-20260806-step34-g3-probe.md +++ b/docs/changelog-20260806-step34-g3-probe.md @@ -115,3 +115,21 @@ browser login confirm over tailnet (needs the vault root CA on the workstation). - Headscale server version remains UNMEASURED (operator has no access this session) -> tag + autoApprovers support verified EMPIRICALLY at apply time. + +## Item 7 -- site-tailscale.sh tooling (committed 2929257) + substrate .7 VM added (both DCs) + +WHAT: (a) committed scripts/site-tailscale.sh + tests/site-tailscale (15/15, gauntlet 101 ALL +GREEN, manifest 100->101) -- the node-side subnet-router tool. (b) Added the .7 Tailscale VM to +BOTH substrate node maps: opentofu/vr1-dc0-substrate/main.tf ("vr1-dc0-tailscale-01") and +vr1-dc1-substrate/main.tf ("vr1-dc1-tailscale-01"), each 2 vCPU / 2 GiB / 25 GiB (Office1 +tailscale shape), macs=[] (pin from virsh domiflist post-apply, pre-enlistment). for_each keyed +-> expect 1 add / 0 change / 0 destroy per DC. +CAPACITY RE-GATED 2026-08-07 (assert, not estimate): dc-dc-whole-host-budget.py at overhead +34/14 (the +2GiB/+2vCPU per DC over the region-era 32/12) -> "RAM 874/1024 = 85%, VERDICT FIT, +150 GiB headroom" (vCPU 258/256 = 101% is a sim overcommit, not a hard ceiling; disk fine). +tofu validate PASS (both substrate roots + all modules). +STILL OWED (gated, on voffice1 -- the inner substrate root runs there, D-128): tofu plan (verify +1 add/0/0) -> gated apply -> pin MACs -> MAAS enlist/commission/deploy -> carve .7 metal-admin + +provider-public legs -> install tailscale. Then the Headscale-side join (deferred, access). +REVERT: remove the "vr1-dc{0,1}-tailscale-01" map entries (for_each keyed -> plans 1 destroy +each if already applied; a pure map removal if not yet applied). diff --git a/opentofu/vr1-dc0-substrate/main.tf b/opentofu/vr1-dc0-substrate/main.tf index 4413a53..096cf3e 100644 --- a/opentofu/vr1-dc0-substrate/main.tf +++ b/opentofu/vr1-dc0-substrate/main.tf @@ -204,6 +204,39 @@ "52:54:00:dc:5c:0b", "52:54:00:81:15:a7", "52:54:00:a9:0b:d6", "52:54:00:a6:8a:94", "52:54:00:db:7f:65", "52:54:00:0c:22:a3"] } + # ---- D-129(iii) AMENDMENT (RULED 2026-08-07): the DEDICATED per-DC TAILSCALE subnet router. + # Rulings (a)-(d), operator, this date: (a) "Dedicated VM at utility .7"; (b) STAR + # (operator->DC only); (c) SINGLE router, HA scale-up PINNED; (d) SNAT ON. NOT a D-121 role + # node, NOT the controller, NOT the region -- those are all unchanged above. `for_each` is + # keyed, so this plans 1 add / 0 change / 0 destroy. + # + # WHY IT EXISTS: the STANDING per-DC operator-access path (gap-register item 21). Operators + # reach this DC's metal-admin plane -- SSH consoles AND the routed dashboards (Horizon on the + # metal-admin VIP 10.12.8.58) -- over the tailnet, via this node advertising 10.12.8.0/22 to + # Headscale (tailscale.baldurkeep.com). It is the node-side half of scripts/site-tailscale.sh. + # + # SIZING: 2 vCPU / 2 GiB / 25 GiB -- the MEASURED Office1-tailscale VM shape (D-129/D-114, + # design-decisions "tailscale -- 2 cores / 2 GiB / 25 GB"). Capacity RE-GATED 2026-08-07: + # dc-dc-whole-host-budget.py --containment-overhead-mem-gib 34 --containment-overhead-vcpu 14 + # -> RAM 874/1024 = 85 pct, VERDICT FIT, 150 GiB headroom (the +2GiB/+2vCPU per DC over the + # region-era 32/12 baseline). + # + # MACs DELIBERATELY EMPTY -- correct ONLY before enlistment (this VM's state at first apply). + # PIN THEM FROM MEASUREMENT (`virsh domiflist vr1-dc0-tailscale-01` on vvr1-dc0) immediately + # after that apply, before MAAS enlistment -- the MAC-regeneration trap that stranded the + # fleet once (2026-07-21) and is why the controller/region MACs are pinned above. + # + # ADDRESSING: utility-band .7 (D-134 octet map, extended by the same 2026-08-07 ruling: .4 + # artifact / .5 Juju controller / .6 MAAS region / .7 Tailscale -- STANDING cross-DC standard, + # divergence is a DEFECT). CARVE BOTH metal-admin (10.12.8.7 -- the plane it ADVERTISES) AND + # provider-public (10.12.4.7, gw 10.12.4.1 -- egress to reach Headscale over the internet) at + # enlistment. metal-admin ALONE is the region-VM under-carve that cost three bootstrap + # attempts (no default route). The node-vm module attaches all six planes; only these two are + # carved and only metal-admin is advertised (SNAT on, ruling d) -- the other four legs stay + # uncarved (the isolated metal-internal/data/storage/replication planes are neither carved nor + # routed by this node). + "vr1-dc0-tailscale-01" = { vcpu = 2, mem = 2048, disk_gib = 25, macs = [] } + } } diff --git a/opentofu/vr1-dc1-substrate/main.tf b/opentofu/vr1-dc1-substrate/main.tf index 9bef530..3b69445 100644 --- a/opentofu/vr1-dc1-substrate/main.tf +++ b/opentofu/vr1-dc1-substrate/main.tf @@ -185,6 +185,19 @@ # dc0 controller VM on 2026-07-30). "vr1-dc1-maas-01" = { vcpu = 4, mem = 8192, disk_gib = 150, macs = [] } + # ---- D-129(iii) AMENDMENT (RULED 2026-08-07): the DEDICATED per-DC TAILSCALE subnet router. + # dc1's copy of the dc0 entry -- identical rationale (rulings a-d: dedicated VM at utility .7, + # STAR, SINGLE router HA-pinned, SNAT on); see vr1-dc0-substrate/main.tf for the full note. + # `for_each` keyed -> 1 add / 0 change / 0 destroy. SIZING 2 vCPU / 2 GiB / 25 GiB (Office1 + # tailscale shape); capacity FIT at the same 34/14 whole-host gate (both DCs modelled together, + # 874/1024 = 85 pct, 150 GiB headroom, 2026-08-07). MACs [] at first apply -> PIN from + # `virsh domiflist vr1-dc1-tailscale-01` on vvr1-dc1 before enlistment (libvirt `52:54:00:`, + # NOT the dc1 schematic scheme -- same as maas-01/juju-01 above). ADDRESSING utility-band .7: + # CARVE metal-admin 10.12.68.7 (the plane it ADVERTISES) AND provider-public 10.12.64.7 + # (gw 10.12.64.1 -- egress to Headscale); the other four legs stay uncarved. Non-overlapping + # with dc0's 10.12.8.0/22 (Headscale has no 4via6 -- D-129(iii) amdt note 3). + "vr1-dc1-tailscale-01" = { vcpu = 2, mem = 2048, disk_gib = 25, macs = [] } + } }