From 00671e1729056d8bdb68e78fe7328415971184d3 Mon Sep 17 00:00:00 2001 From: panxiao81 Date: Thu, 17 Sep 2026 13:17:15 +0000 Subject: [PATCH] =?UTF-8?q?=E7=BB=9F=E4=B8=80=20DN42=20DNS=20=E4=B8=8E?= =?UTF-8?q?=E5=AE=BF=E4=B8=BB=20Docker=20=E5=9C=B0=E5=9D=80=E6=B1=A0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- .ansible/.lock | 0 .gitignore | 2 + apps/blocky/compose.yaml | 9 +++- apps/blocky/config.yml | 13 +++-- apps/netbox/terraform/topology.yml | 20 +++++--- apps/ps3netsrv/docker-compose.yml | 7 +++ infrastructure/dns/records.yml | 18 +++++++ infrastructure/docker/README.md | 27 ++++++++++ infrastructure/docker/ansible/ansible.cfg | 2 + infrastructure/docker/ansible/site.yml | 61 +++++++++++++++++++++++ 10 files changed, 146 insertions(+), 13 deletions(-) delete mode 100644 .ansible/.lock create mode 100644 infrastructure/docker/README.md create mode 100644 infrastructure/docker/ansible/ansible.cfg create mode 100644 infrastructure/docker/ansible/site.yml diff --git a/.ansible/.lock b/.ansible/.lock deleted file mode 100644 index e69de29..0000000 diff --git a/.gitignore b/.gitignore index 626e24d..c01ef5a 100644 --- a/.gitignore +++ b/.gitignore @@ -49,6 +49,7 @@ authelia/secret.yaml **/secret.yaml **/credentials.yml **/terraform.tfvars +**/credentials.auto.tfvars **/tailscale/helm.sh **/cloudflared/backup/ **/cloudflared/secret.yaml @@ -118,3 +119,4 @@ apps/netboot/config/log/ # Blocky's per-day query logs. Bind-mounted into the container, one file per # day, and every DNS query the LAN makes ends up in them. apps/blocky/logs/ +.venv/ diff --git a/apps/blocky/compose.yaml b/apps/blocky/compose.yaml index e5c85d5..13839f7 100644 --- a/apps/blocky/compose.yaml +++ b/apps/blocky/compose.yaml @@ -1,4 +1,4 @@ -# Blocky — LAN DNS. STAGED, NOT DEPLOYED. See README.md. +# Blocky — 已部署的 LAN 主 DNS。见 README.md。 # # WHY compose on the laptop and NOT a k3s Deployment, given everything else here # is Kubernetes: @@ -52,3 +52,10 @@ services: options: max-size: "10m" max-file: "3" + +# 避免与 DN42 的 172.20.0.0/14 重叠。 +networks: + default: + ipam: + config: + - subnet: 172.28.0.0/24 diff --git a/apps/blocky/config.yml b/apps/blocky/config.yml index 6adc628..8c2222d 100644 --- a/apps/blocky/config.yml +++ b/apps/blocky/config.yml @@ -1,9 +1,7 @@ # Blocky — LAN resolver, ad-blocker and split-horizon DNS. # -# DEPLOYED 2026-07-28 and verified, but NOT yet the LAN resolver — clients still -# get the DC/router pair from DHCP. Making it the resolver needs a DHCP change on -# the NEC IX; see README.md. Until then only clients that query 192.168.10.127 -# explicitly are affected, so this is safely reversible. +# LAN 主 DNS 为 192.168.10.127，NEC IX 192.168.10.1 为备用。 +# DN42 条件转发经 VyOS，参见 README.md。 ports: # These are the CONTAINER's listen addresses, so they must be unqualified — @@ -35,6 +33,13 @@ conditional: # Queries for the AD zone go straight to the DC, which is authoritative. This # replaces the "DC first, router second" resolver ordering that clients use today. mapping: + # DN42 由 VyOS 使用注册地址转发，避免 LAN 私网源地址缺少回程。 + dn42: 192.168.10.2 + 20.172.in-addr.arpa: 192.168.10.2 + 21.172.in-addr.arpa: 192.168.10.2 + 22.172.in-addr.arpa: 192.168.10.2 + 23.172.in-addr.arpa: 192.168.10.2 + d.f.ip6.arpa: 192.168.10.2 ad.ddupan.top: 192.168.10.5 # Reverse lookups for LAN hosts — the DC holds the reverse zone. 10.168.192.in-addr.arpa: 192.168.10.5 diff --git a/apps/netbox/terraform/topology.yml b/apps/netbox/terraform/topology.yml index 07bedc4..2dfe4b5 100644 --- a/apps/netbox/terraform/topology.yml +++ b/apps/netbox/terraform/topology.yml @@ -52,11 +52,16 @@ prefix_roles: # range. It makes the collision VISIBLE — the range shows 100% utilised and the # address never appears as a suggestion — where plain YAML shows nothing at all. ip_ranges: - - start: 192.168.10.10/24 + - start: 192.168.10.128/24 end: 192.168.10.250/24 status: active mark_utilized: true - description: "NEC IX DHCP pool — do NOT statically allocate inside this." + description: "NEC IX DHCP pool, updated 2026-09-14. Do NOT statically allocate inside this." + - start: 192.168.10.251/24 + end: 192.168.10.254/24 + status: reserved + mark_utilized: true + description: "用户确认预留，尚未分配；不可按扫描无响应视为空闲。" vlan_group: name: lab @@ -144,8 +149,8 @@ devices: role: hypervisor type: 10vgcto1ww serial: PC1AGX1Q - description: "Proxmox VE 9.2. LINSTOR satellite. The node that randomly froze." - comments: "AMD Ryzen 5 PRO 2400GE w/ Vega, 8 threads, 7 GiB RAM. BIOS M1XKT45A. Raven Ridge idle bug fixed in BIOS: Power Supply Idle Control = Typical Current Idle." + description: "Proxmox VE 9.2. LINSTOR satellite." + comments: "AMD Ryzen 5 PRO 2400GE w/ Vega, 8 threads, 7 GiB RAM. BIOS M1XKT45A." interfaces: - { name: vmbr0, type: bridge, ip: 192.168.10.7/24, primary: true, mtu: 9000, dns_name: pve2.ad.ddupan.top } @@ -154,7 +159,7 @@ devices: type: 10vgcto1ww serial: PC1AGX1P description: "Proxmox VE 9.2. LINSTOR satellite." - comments: "AMD Ryzen 5 PRO 2400GE w/ Vega, 8 threads, 7 GiB RAM. BIOS M1XKT55A. Same silicon as pve2, so susceptible to the same idle bug in principle." + comments: "AMD Ryzen 5 PRO 2400GE w/ Vega, 8 threads, 7 GiB RAM. BIOS M1XKT55A." interfaces: - { name: vmbr0, type: bridge, ip: 192.168.10.9/24, primary: true, mtu: 9000, dns_name: pve3.ad.ddupan.top } @@ -181,9 +186,8 @@ devices: # Wi-Fi. Runs as an AP/bridge, not a router — the NEC IX is the gateway, so this box's # routing, NAT and DHCP are not in play. Wireless clients land directly on the flat LAN. # - # ⚠ Its address .10 is the FIRST ADDRESS OF THE DHCP POOL above. Either it holds a lease - # (so the address can move) or it is a static that overlaps the pool. NetBox surfaces - # the overlap; the underlying config still needs a decision. See ../README.md. + # 2026-09-14: NEC IX 为此 MAC 固定分配 .10；动态池已迁到 .128–.250。 + # 操作与回滚记录：infrastructure/samba-ad/router-dhcp-nec-ix.md。 # # Identified by MAC OUI d4:2c:46 = BUFFALO.INC plus the model string on its login page. - name: ap-buffalo diff --git a/apps/ps3netsrv/docker-compose.yml b/apps/ps3netsrv/docker-compose.yml index abf8908..78f7342 100644 --- a/apps/ps3netsrv/docker-compose.yml +++ b/apps/ps3netsrv/docker-compose.yml @@ -12,3 +12,10 @@ services: - "38008:38008" volumes: - "/mnt/pool/games/ps3:/games:rw" + +# 避免与 DN42 的 172.20.0.0/14 重叠。 +networks: + default: + ipam: + config: + - subnet: 172.28.1.0/24 diff --git a/infrastructure/dns/records.yml b/infrastructure/dns/records.yml index d4245e8..ef03c46 100644 --- a/infrastructure/dns/records.yml +++ b/infrastructure/dns/records.yml @@ -10,6 +10,9 @@ homelab_dns: - { zone: ad.ddupan.top, name: pve1, type: A, values: [192.168.10.4] } - { zone: ad.ddupan.top, name: pve2, type: A, values: [192.168.10.7] } - { zone: ad.ddupan.top, name: pve3, type: A, values: [192.168.10.9] } + - { zone: ad.ddupan.top, name: sandbox1, type: A, values: [10.60.0.11] } + - { zone: ad.ddupan.top, name: sandbox2, type: A, values: [10.60.0.12] } + - { zone: ad.ddupan.top, name: sandbox-k8s, type: A, values: [10.60.0.13] } - { zone: ad.ddupan.top, name: retrolab, type: A, values: [10.60.0.10] } - { zone: ad.ddupan.top, name: grafana, type: A, values: [192.168.10.127] } - { zone: ad.ddupan.top, name: netbox, type: A, values: [192.168.10.127] } @@ -53,3 +56,18 @@ homelab_dns: values: [ff392451-b0b1-45bb-964e-6d9372c3a9e3.cfargotunnel.com] proxied: true terraform: { managed: false } + # OCI 主机直接解析公网 IP，SSH 不经过 Cloudflare 代理。 + - name: oci-arm.ddupan.top + type: A + values: + - 129.225.138.179 + proxied: false + ttl: 300 + terraform: { managed: false } + - name: oci-amd.ddupan.top + type: A + values: + - 129.225.176.134 + proxied: false + ttl: 300 + terraform: { managed: false } diff --git a/infrastructure/docker/README.md b/infrastructure/docker/README.md new file mode 100644 index 0000000..485890d --- /dev/null +++ b/infrastructure/docker/README.md @@ -0,0 +1,27 @@ +# Docker 地址池与 DN42 + +DN42 使用 `172.20.0.0/14`。laptop 的 Docker 默认地址池改为 `172.28.0.0/16`， +按 `/24` 分配新 bridge，避免本地直连路由与 DN42 前缀重叠。 +`ansible/site.yml` 合并现有 daemon.json，保留 NVIDIA runtime；先热加载 live-restore， +再重启 daemon 使默认地址池生效，避免已有容器随 daemon 停止。 + +```bash +ANSIBLE_LOCAL_TEMP=/tmp/ansible-docker ansible-playbook -i localhost, infrastructure/docker/ansible/site.yml --check --diff +ANSIBLE_LOCAL_TEMP=/tmp/ansible-docker ansible-playbook -i localhost, infrastructure/docker/ansible/site.yml +``` + +已有网络不会自动换地址。本次单独迁移结果： + +| 网络 | 原地址 | 当前地址/状态 | +|---|---|---| +| blocky_default | 172.20.0.0/16 | 172.28.0.0/24，Compose 明确声明 | +| ps3netsrv_default | 172.21.0.0/16 | 172.28.1.0/24，Compose 明确声明 | +| research-auto_default | 172.22.0.0/16 | 172.28.2.0/24，仓库外 research-auto Compose 明确声明 | +| netboot_default | 172.23.0.0/16 | 删除无端点的遗留网络；netboot 两个容器均使用 host 网络 | + +Blocky 健康检查与 DNS 查询通过；ps3netsrv 运行，游戏数据挂载保留。 +research-auto 的 postgres 容器仅 create、未启动，原命名卷 `research-auto_postgres_data` 保留。 + +旧运行容器曾引用仓库重组前的 `/home/panxiao81/services/` 挂载路径； +本次 Blocky 已用 `apps/blocky` 路径重建，netboot 等未重建的容器仍需在重建时使用当前 Compose。 +不要在未检查 bind mount 路径的情况下关闭 live-restore 并重启所有容器。 diff --git a/infrastructure/docker/ansible/ansible.cfg b/infrastructure/docker/ansible/ansible.cfg new file mode 100644 index 0000000..9a7b491 --- /dev/null +++ b/infrastructure/docker/ansible/ansible.cfg @@ -0,0 +1,2 @@ +[defaults] +local_tmp = /tmp/ansible-docker diff --git a/infrastructure/docker/ansible/site.yml b/infrastructure/docker/ansible/site.yml new file mode 100644 index 0000000..3ff9be2 --- /dev/null +++ b/infrastructure/docker/ansible/site.yml @@ -0,0 +1,61 @@ +--- +- name: 为 DN42 排除 Docker 地址池重叠 + hosts: localhost + connection: local + become: true + gather_facts: false + vars: + ansible_python_interpreter: /usr/bin/python3 + docker_address_pools: + - base: 172.28.0.0/16 + size: 24 + tasks: + - name: 读取现有 Docker 配置并保留 runtimes 等设置 + ansible.builtin.slurp: + src: /etc/docker/daemon.json + register: docker_config + no_log: true + + # 先让旧 daemon 知道 live-restore，随后重启才能保留运行容器。 + - name: 启用 live-restore + ansible.builtin.copy: + content: "{{ (docker_config.content | b64decode | from_json | combine({'live-restore': true})) | to_nice_json }}\n" + dest: /etc/docker/daemon.json + owner: root + group: root + mode: '0644' + backup: true + validate: /usr/bin/dockerd --validate --config-file %s + register: live_restore_config + + - name: 热重载 live-restore + ansible.builtin.systemd_service: + name: docker + state: reloaded + when: live_restore_config.changed and not ansible_check_mode + + - name: 确认运行中的 daemon 已启用 live-restore + ansible.builtin.command: docker info --format '{{ '{{' }}.LiveRestoreEnabled{{ '}}' }}' + register: live_restore_status + changed_when: false + retries: 5 + delay: 2 + until: live_restore_status.stdout == 'true' + when: not ansible_check_mode + + - name: 配置 DN42 范围之外的默认地址池 + ansible.builtin.copy: + content: "{{ (docker_config.content | b64decode | from_json | combine({'live-restore': true, 'default-address-pools': docker_address_pools})) | to_nice_json }}\n" + dest: /etc/docker/daemon.json + owner: root + group: root + mode: '0644' + backup: true + validate: /usr/bin/dockerd --validate --config-file %s + register: docker_pool_config + + - name: 保留运行容器并重启 daemon 使地址池生效 + ansible.builtin.systemd_service: + name: docker + state: restarted + when: docker_pool_config.changed and not ansible_check_mode