feat: 纳管共享 etcd 与 k3s 外 PostgreSQL 高可用及备份

2026-09-25 19:34:48 +00:00
parent acd4b55722
commit 3a2fe5fa0c
92 changed files with 4211 additions and 0 deletions
@@ -0,0 +1,74 @@
+---
+# 仅在 Terraform 身份配置完成后部署；预检失败不启用定时器。
+- name: 安装独立于人工会话的续签调度
+  hosts: etcd-laptop
+  become: true
+  gather_facts: false
+  tasks:
+    - name: 创建 root 管理的程序目录
+      ansible.builtin.file:
+        path: /opt/homelab-etcd-controller
+        state: directory
+        mode: '0755'
+    - name: 安装证书登录与调度程序
+      ansible.builtin.copy:
+        src: "../controller/{{ item }}"
+        dest: "/opt/homelab-etcd-controller/{{ item }}"
+        owner: root
+        group: root
+        mode: '0755'
+      loop: [login.py, renew.py]
+    - name: 以机器身份预检（不输出 token）
+      ansible.builtin.command:
+        argv: [/usr/bin/python3, /opt/homelab-etcd-controller/login.py]
+      changed_when: false
+      no_log: true
+    - name: 安装固定的 Ansible 配置副本
+      ansible.builtin.copy:
+        src: "{{ playbook_dir }}/"
+        dest: /opt/homelab-etcd-controller/ansible/
+        owner: root
+        group: root
+        mode: preserve
+    - name: 创建调度状态目录
+      ansible.builtin.file:
+        path: /var/lib/homelab-etcd-controller
+        state: directory
+        owner: panxiao81
+        group: panxiao81
+        mode: '0700'
+    - name: 安装续签 oneshot unit
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/homelab-etcd-renew.service
+        mode: '0644'
+        content: |
+          [Unit]
+          Description=Renew shared etcd certificates through Bao machine identity
+          After=network-online.target
+          [Service]
+          Type=oneshot
+          User=panxiao81
+          Environment=HOME=/home/panxiao81
+          Environment=PATH=/home/panxiao81/.local/bin:/usr/local/bin:/usr/bin:/bin
+          ExecStart=/usr/bin/python3 /opt/homelab-etcd-controller/renew.py
+          TimeoutStartSec=30min
+          UMask=0077
+    - name: 安装每日续签 timer
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/homelab-etcd-renew.timer
+        mode: '0644'
+        content: |
+          [Unit]
+          Description=Daily shared etcd certificate renewal check
+          [Timer]
+          OnCalendar=*-*-* 04:10:00 UTC
+          RandomizedDelaySec=15min
+          Persistent=true
+          [Install]
+          WantedBy=timers.target
+    - name: 启用续签调度
+      ansible.builtin.systemd_service:
+        name: homelab-etcd-renew.timer
+        daemon_reload: true
+        enabled: true
+        state: started