统一 DN42 DNS 与宿主 Docker 地址池

2026-09-17 13:22:49 +00:00
parent 76f94f4f31
commit a08c8a7303
10 changed files with 146 additions and 13 deletions
@@ -49,6 +49,7 @@ authelia/secret.yaml
 **/secret.yaml
 **/credentials.yml
 **/terraform.tfvars
+**/credentials.auto.tfvars
 **/tailscale/helm.sh
 **/cloudflared/backup/
 **/cloudflared/secret.yaml
@@ -118,3 +119,4 @@ apps/netboot/config/log/
 # Blocky's per-day query logs. Bind-mounted into the container, one file per
 # day, and every DNS query the LAN makes ends up in them.
 apps/blocky/logs/
+.venv/
@@ -1,4 +1,4 @@
-# Blocky — LAN DNS. STAGED, NOT DEPLOYED. See README.md.
+# Blocky — 已部署的 LAN 主 DNS。见 README.md。
 #
 # WHY compose on the laptop and NOT a k3s Deployment, given everything else here
 # is Kubernetes:
@@ -52,3 +52,10 @@ services:
      options:
        max-size: "10m"
        max-file: "3"
+
+# 避免与 DN42 的 172.20.0.0/14 重叠。
+networks:
+  default:
+    ipam:
+      config:
+      - subnet: 172.28.0.0/24
@@ -1,9 +1,7 @@
 # Blocky — LAN resolver, ad-blocker and split-horizon DNS.
 #
-# DEPLOYED 2026-07-28 and verified, but NOT yet the LAN resolver — clients still
-# get the DC/router pair from DHCP. Making it the resolver needs a DHCP change on
-# the NEC IX; see README.md. Until then only clients that query 192.168.10.127
-# explicitly are affected, so this is safely reversible.
+# LAN 主 DNS 为 192.168.10.127，NEC IX 192.168.10.1 为备用。
+# DN42 条件转发经 VyOS，参见 README.md。

 ports:
  # These are the CONTAINER's listen addresses, so they must be unqualified —
@@ -35,6 +33,13 @@ conditional:
  # Queries for the AD zone go straight to the DC, which is authoritative. This
  # replaces the "DC first, router second" resolver ordering that clients use today.
  mapping:
+    # DN42 由 VyOS 使用注册地址转发，避免 LAN 私网源地址缺少回程。
+    dn42: 192.168.10.2
+    20.172.in-addr.arpa: 192.168.10.2
+    21.172.in-addr.arpa: 192.168.10.2
+    22.172.in-addr.arpa: 192.168.10.2
+    23.172.in-addr.arpa: 192.168.10.2
+    d.f.ip6.arpa: 192.168.10.2
    ad.ddupan.top: 192.168.10.5
    # Reverse lookups for LAN hosts — the DC holds the reverse zone.
    10.168.192.in-addr.arpa: 192.168.10.5
@@ -52,11 +52,16 @@ prefix_roles:
 # range. It makes the collision VISIBLE — the range shows 100% utilised and the
 # address never appears as a suggestion — where plain YAML shows nothing at all.
 ip_ranges:
-  - start: 192.168.10.10/24
+  - start: 192.168.10.128/24
    end: 192.168.10.250/24
    status: active
    mark_utilized: true
-    description: "NEC IX DHCP pool — do NOT statically allocate inside this."
+    description: "NEC IX DHCP pool, updated 2026-09-14. Do NOT statically allocate inside this."
+  - start: 192.168.10.251/24
+    end: 192.168.10.254/24
+    status: reserved
+    mark_utilized: true
+    description: "用户确认预留，尚未分配；不可按扫描无响应视为空闲。"

 vlan_group:
  name: lab
@@ -144,8 +149,8 @@ devices:
    role: hypervisor
    type: 10vgcto1ww
    serial: PC1AGX1Q
-    description: "Proxmox VE 9.2. LINSTOR satellite. The node that randomly froze."
-    comments: "AMD Ryzen 5 PRO 2400GE w/ Vega, 8 threads, 7 GiB RAM. BIOS M1XKT45A. Raven Ridge idle bug fixed in BIOS: Power Supply Idle Control = Typical Current Idle."
+    description: "Proxmox VE 9.2. LINSTOR satellite."
+    comments: "AMD Ryzen 5 PRO 2400GE w/ Vega, 8 threads, 7 GiB RAM. BIOS M1XKT45A."
    interfaces:
      - { name: vmbr0, type: bridge, ip: 192.168.10.7/24, primary: true, mtu: 9000, dns_name: pve2.ad.ddupan.top }

@@ -154,7 +159,7 @@ devices:
    type: 10vgcto1ww
    serial: PC1AGX1P
    description: "Proxmox VE 9.2. LINSTOR satellite."
-    comments: "AMD Ryzen 5 PRO 2400GE w/ Vega, 8 threads, 7 GiB RAM. BIOS M1XKT55A. Same silicon as pve2, so susceptible to the same idle bug in principle."
+    comments: "AMD Ryzen 5 PRO 2400GE w/ Vega, 8 threads, 7 GiB RAM. BIOS M1XKT55A."
    interfaces:
      - { name: vmbr0, type: bridge, ip: 192.168.10.9/24, primary: true, mtu: 9000, dns_name: pve3.ad.ddupan.top }

@@ -181,9 +186,8 @@ devices:
  # Wi-Fi. Runs as an AP/bridge, not a router — the NEC IX is the gateway, so this box's
  # routing, NAT and DHCP are not in play. Wireless clients land directly on the flat LAN.
  #
-  # ⚠ Its address .10 is the FIRST ADDRESS OF THE DHCP POOL above. Either it holds a lease
-  # (so the address can move) or it is a static that overlaps the pool. NetBox surfaces
-  # the overlap; the underlying config still needs a decision. See ../README.md.
+  # 2026-09-14: NEC IX 为此 MAC 固定分配 .10；动态池已迁到 .128–.250。
+  # 操作与回滚记录：infrastructure/samba-ad/router-dhcp-nec-ix.md。
  #
  # Identified by MAC OUI d4:2c:46 = BUFFALO.INC plus the model string on its login page.
  - name: ap-buffalo
@@ -12,3 +12,10 @@ services:
      - "38008:38008"
    volumes:
      - "/mnt/pool/games/ps3:/games:rw"
+
+# 避免与 DN42 的 172.20.0.0/14 重叠。
+networks:
+  default:
+    ipam:
+      config:
+      - subnet: 172.28.1.0/24
@@ -10,6 +10,9 @@ homelab_dns:
      - { zone: ad.ddupan.top, name: pve1, type: A, values: [192.168.10.4] }
      - { zone: ad.ddupan.top, name: pve2, type: A, values: [192.168.10.7] }
      - { zone: ad.ddupan.top, name: pve3, type: A, values: [192.168.10.9] }
+      - { zone: ad.ddupan.top, name: sandbox1, type: A, values: [10.60.0.11] }
+      - { zone: ad.ddupan.top, name: sandbox2, type: A, values: [10.60.0.12] }
+      - { zone: ad.ddupan.top, name: sandbox-k8s, type: A, values: [10.60.0.13] }
      - { zone: ad.ddupan.top, name: retrolab, type: A, values: [10.60.0.10] }
      - { zone: ad.ddupan.top, name: grafana, type: A, values: [192.168.10.127] }
      - { zone: ad.ddupan.top, name: netbox, type: A, values: [192.168.10.127] }
@@ -53,3 +56,18 @@ homelab_dns:
        values: [ff392451-b0b1-45bb-964e-6d9372c3a9e3.cfargotunnel.com]
        proxied: true
        terraform: { managed: false }
+      # OCI 主机直接解析公网 IP，SSH 不经过 Cloudflare 代理。
+      - name: oci-arm.ddupan.top
+        type: A
+        values:
+        - 129.225.138.179
+        proxied: false
+        ttl: 300
+        terraform: { managed: false }
+      - name: oci-amd.ddupan.top
+        type: A
+        values:
+        - 129.225.176.134
+        proxied: false
+        ttl: 300
+        terraform: { managed: false }
@@ -0,0 +1,27 @@
+# Docker 地址池与 DN42
+
+DN42 使用 `172.20.0.0/14`。laptop 的 Docker 默认地址池改为 `172.28.0.0/16`，
+按 `/24` 分配新 bridge，避免本地直连路由与 DN42 前缀重叠。
+`ansible/site.yml` 合并现有 daemon.json，保留 NVIDIA runtime；先热加载 live-restore，
+再重启 daemon 使默认地址池生效，避免已有容器随 daemon 停止。
+
+```bash
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-docker ansible-playbook -i localhost, infrastructure/docker/ansible/site.yml --check --diff
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-docker ansible-playbook -i localhost, infrastructure/docker/ansible/site.yml
+```
+
+已有网络不会自动换地址。本次单独迁移结果：
+
+| 网络 | 原地址 | 当前地址/状态 |
+|---|---|---|
+| blocky_default | 172.20.0.0/16 | 172.28.0.0/24，Compose 明确声明 |
+| ps3netsrv_default | 172.21.0.0/16 | 172.28.1.0/24，Compose 明确声明 |
+| research-auto_default | 172.22.0.0/16 | 172.28.2.0/24，仓库外 research-auto Compose 明确声明 |
+| netboot_default | 172.23.0.0/16 | 删除无端点的遗留网络；netboot 两个容器均使用 host 网络 |
+
+Blocky 健康检查与 DNS 查询通过；ps3netsrv 运行，游戏数据挂载保留。
+research-auto 的 postgres 容器仅 create、未启动，原命名卷 `research-auto_postgres_data` 保留。
+
+旧运行容器曾引用仓库重组前的 `/home/panxiao81/services/<app>` 挂载路径；
+本次 Blocky 已用 `apps/blocky` 路径重建，netboot 等未重建的容器仍需在重建时使用当前 Compose。
+不要在未检查 bind mount 路径的情况下关闭 live-restore 并重启所有容器。
@@ -0,0 +1,2 @@
+[defaults]
+local_tmp = /tmp/ansible-docker
@@ -0,0 +1,61 @@
+---
+- name: 为 DN42 排除 Docker 地址池重叠
+  hosts: localhost
+  connection: local
+  become: true
+  gather_facts: false
+  vars:
+    ansible_python_interpreter: /usr/bin/python3
+    docker_address_pools:
+      - base: 172.28.0.0/16
+        size: 24
+  tasks:
+    - name: 读取现有 Docker 配置并保留 runtimes 等设置
+      ansible.builtin.slurp:
+        src: /etc/docker/daemon.json
+      register: docker_config
+      no_log: true
+
+    # 先让旧 daemon 知道 live-restore，随后重启才能保留运行容器。
+    - name: 启用 live-restore
+      ansible.builtin.copy:
+        content: "{{ (docker_config.content | b64decode | from_json | combine({'live-restore': true})) | to_nice_json }}\n"
+        dest: /etc/docker/daemon.json
+        owner: root
+        group: root
+        mode: '0644'
+        backup: true
+        validate: /usr/bin/dockerd --validate --config-file %s
+      register: live_restore_config
+
+    - name: 热重载 live-restore
+      ansible.builtin.systemd_service:
+        name: docker
+        state: reloaded
+      when: live_restore_config.changed and not ansible_check_mode
+
+    - name: 确认运行中的 daemon 已启用 live-restore
+      ansible.builtin.command: docker info --format '{{ '{{' }}.LiveRestoreEnabled{{ '}}' }}'
+      register: live_restore_status
+      changed_when: false
+      retries: 5
+      delay: 2
+      until: live_restore_status.stdout == 'true'
+      when: not ansible_check_mode
+
+    - name: 配置 DN42 范围之外的默认地址池
+      ansible.builtin.copy:
+        content: "{{ (docker_config.content | b64decode | from_json | combine({'live-restore': true, 'default-address-pools': docker_address_pools})) | to_nice_json }}\n"
+        dest: /etc/docker/daemon.json
+        owner: root
+        group: root
+        mode: '0644'
+        backup: true
+        validate: /usr/bin/dockerd --validate --config-file %s
+      register: docker_pool_config
+
+    - name: 保留运行容器并重启 daemon 使地址池生效
+      ansible.builtin.systemd_service:
+        name: docker
+        state: restarted
+      when: docker_pool_config.changed and not ansible_check_mode