排除 OCI HelmRepository 正常缺失 Ready 条件的误报

Reviewed-on: #154

.gitea/workflows/ansible.yml

@@ -16,9 +16,6 @@ on:
       - '.ansible-lint'
       - '.gitea/workflows/ansible.yml'
 
-env:
-  ANSIBLE_COLLECTIONS_PATH: /root/.ansible/collections
-
 jobs:
   lint:
     runs-on: [self-hosted, pod]
@@ -30,6 +27,7 @@ jobs:
           python3 -m pip install --user --break-system-packages \
             --index-url https://pypi.org/simple --quiet uv==0.11.7
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
+          echo "ANSIBLE_COLLECTIONS_PATH=$HOME/.ansible/collections" >> "$GITHUB_ENV"
 
       - name: Install ansible-lint and collections
         run: |
@@ -50,7 +48,7 @@ jobs:
       - name: ansible-lint
         run: |
           export PATH="$HOME/.local/bin:$PATH"
-          export ANSIBLE_COLLECTIONS_PATH="$PWD/infrastructure/samba-ad/ansible/collections:/root/.ansible/collections"
+          export ANSIBLE_COLLECTIONS_PATH="$PWD/infrastructure/samba-ad/ansible/collections:$HOME/.ansible/collections"
           # 静态检查不应依赖生产 vault 凭据。一次性 checkout 可以去掉加密变量文件；
           # syntax-check 只验证结构，不需要解析变量的运行时值。
           rm -f \

.gitea/workflows/hydra.yml

@@ -0,0 +1,22 @@
+name: hydra-login
+on:
+  pull_request:
+    paths:
+      - 'apps/hydra/login-consent/**'
+      - '.gitea/workflows/hydra.yml'
+  workflow_dispatch:
+jobs:
+  verify:
+    runs-on: [self-hosted, pod]
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-go@v5
+        with:
+          go-version-file: apps/hydra/login-consent/go.mod
+          cache-dependency-path: apps/hydra/login-consent/go.sum
+      - name: Test authentication boundaries
+        working-directory: apps/hydra/login-consent
+        run: |
+          go test -race ./...
+          go vet ./...
+          CGO_ENABLED=0 go build -trimpath .

.gitignore

@@ -49,6 +49,7 @@ authelia/secret.yaml
 **/secret.yaml
 **/credentials.yml
 **/terraform.tfvars
+**/credentials.auto.tfvars
 **/tailscale/helm.sh
 **/cloudflared/backup/
 **/cloudflared/secret.yaml
@@ -118,3 +119,4 @@ apps/netboot/config/log/
 # Blocky's per-day query logs. Bind-mounted into the container, one file per
 # day, and every DNS query the LAN makes ends up in them.
 apps/blocky/logs/
+.venv/

apps/backstage/README.md

@@ -0,0 +1,20 @@
+# Backstage
+
+Backstage 作为 homelab 的只读开发者门户运行。应用源码、插件、测试和镜像构建归
+`panxiao81/backstage` 仓库管理；本目录只保存 Kubernetes/Flux 部署声明，并通过
+OCI digest 固定镜像。
+
+## 外部前置
+
+- OpenBao `kv/k8s/backstage` 必须包含以下与容器环境变量同名的字段：
+  `BACKEND_SECRET`、`AUTH_SESSION_SECRET`、`AUTH_OIDC_CLIENT_ID`、
+  `AUTH_OIDC_CLIENT_SECRET`、`POSTGRES_PASSWORD`、`GITEA_TOKEN`。
+- PostgreSQL 需要在共享集群中预先创建由 `backstage` 角色拥有的 `backstage`
+  数据库；密码必须与 OpenBao 中的 `POSTGRES_PASSWORD` 一致。
+- Authelia OIDC 客户端回调地址为
+  `https://backstage.ad.ddupan.top/api/auth/oidc/handler/frame`。
+- AD DNS 需要将 `backstage.ad.ddupan.top` 指向 Envoy Gateway
+  `192.168.10.127`。
+
+Flux 等待 ExternalSecret 和 Deployment 就绪；任何前置缺失都会使该
+Kustomization 保持 NotReady，而不会回退到明文 Secret。

apps/backstage/deployment.yaml

@@ -0,0 +1,85 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backstage
+  namespace: backstage
+  labels:
+    app.kubernetes.io/name: backstage
+    backstage.io/kubernetes-id: homelab-backstage
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: backstage
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: backstage
+        backstage.io/kubernetes-id: homelab-backstage
+    spec:
+      serviceAccountName: backstage
+      securityContext:
+        fsGroup: 1000
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: backstage
+          image: zot.ad.ddupan.top/panxiao81/backstage@sha256:e5a12550726f19a680bc7c40e2cc07cc624318f9279ee121814d293a006ef210
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: BACKSTAGE_BASE_URL
+              value: https://backstage.ad.ddupan.top
+            - name: POSTGRES_HOST
+              value: shared-postgresql-rw.shared-db.svc.cluster.local
+            - name: POSTGRES_PORT
+              value: "5432"
+            - name: POSTGRES_USER
+              value: backstage
+            - name: POSTGRES_DATABASE
+              value: backstage
+            - name: GITEA_HOST
+              value: git.ddupan.top
+          envFrom:
+            - secretRef:
+                name: backstage
+          ports:
+            - containerPort: 7007
+              name: http
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /.backstage/health/v1/readiness
+              port: http
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+          livenessProbe:
+            httpGet:
+              path: /.backstage/health/v1/liveness
+              port: http
+            initialDelaySeconds: 30
+            periodSeconds: 20
+            timeoutSeconds: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 512Mi
+            limits:
+              cpu: "1"
+              memory: 1Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop: [ALL]
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+          volumeMounts:
+            - mountPath: /tmp
+              name: tmp
+      volumes:
+        - emptyDir: {}
+          name: tmp

apps/backstage/external-secret.yaml

@@ -0,0 +1,16 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: backstage
+  namespace: backstage
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    creationPolicy: Owner
+    name: backstage
+  dataFrom:
+    - extract:
+        key: k8s/backstage

apps/backstage/httproute.yaml

@@ -0,0 +1,20 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: backstage
+  namespace: backstage
+spec:
+  parentRefs:
+    - name: eg
+      namespace: envoy-gateway-system
+      sectionName: https
+  hostnames:
+    - backstage.ad.ddupan.top
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: backstage
+          port: 7007

apps/backstage/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - serviceaccount.yaml
+  - rbac.yaml
+  - external-secret.yaml
+  - deployment.yaml
+  - service.yaml
+  - networkpolicy.yaml
+  - httproute.yaml

apps/backstage/namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: backstage
+  labels:
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/enforce-version: v1.36

apps/backstage/networkpolicy.yaml

@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: backstage-ingress
+  namespace: backstage
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: backstage
+  policyTypes: [Ingress]
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: envoy-gateway-system
+      ports:
+        - port: 7007
+          protocol: TCP
+    - from:
+        - ipBlock:
+            cidr: 192.168.10.127/32
+      ports:
+        - port: 7007
+          protocol: TCP

apps/backstage/rbac.yaml

@@ -0,0 +1,51 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: backstage-read-only
+rules:
+  - apiGroups: [""]
+    resources:
+      - configmaps
+      - limitranges
+      - pods
+      - pods/log
+      - resourcequotas
+      - services
+    verbs: [get, list, watch]
+  - apiGroups: [apps]
+    resources:
+      - daemonsets
+      - deployments
+      - replicasets
+      - statefulsets
+    verbs: [get, list, watch]
+  - apiGroups: [autoscaling]
+    resources:
+      - horizontalpodautoscalers
+    verbs: [get, list, watch]
+  - apiGroups: [batch]
+    resources:
+      - cronjobs
+      - jobs
+    verbs: [get, list, watch]
+  - apiGroups: [networking.k8s.io]
+    resources:
+      - ingresses
+    verbs: [get, list, watch]
+  - apiGroups: [metrics.k8s.io]
+    resources:
+      - pods
+    verbs: [get, list]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: backstage-read-only
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: backstage-read-only
+subjects:
+  - kind: ServiceAccount
+    name: backstage
+    namespace: backstage

apps/backstage/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: backstage
+  namespace: backstage
+  labels:
+    backstage.io/kubernetes-id: homelab-backstage
+spec:
+  selector:
+    app.kubernetes.io/name: backstage
+  ports:
+    - name: http
+      port: 7007
+      protocol: TCP
+      targetPort: http

apps/backstage/serviceaccount.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: backstage
+  namespace: backstage
+automountServiceAccountToken: true

apps/blocky/compose.yaml

@@ -1,4 +1,4 @@
-# Blocky — LAN DNS. STAGED, NOT DEPLOYED. See README.md.
+# Blocky — 已部署的 LAN 主 DNS。见 README.md。
 #
 # WHY compose on the laptop and NOT a k3s Deployment, given everything else here
 # is Kubernetes:
@@ -52,3 +52,10 @@ services:
       options:
         max-size: "10m"
         max-file: "3"
+
+# 避免与 DN42 的 172.20.0.0/14 重叠。
+networks:
+  default:
+    ipam:
+      config:
+        - subnet: 172.28.0.0/24

apps/blocky/config.yml

@@ -1,9 +1,7 @@
 # Blocky — LAN resolver, ad-blocker and split-horizon DNS.
 #
-# DEPLOYED 2026-07-28 and verified, but NOT yet the LAN resolver — clients still
-# get the DC/router pair from DHCP. Making it the resolver needs a DHCP change on
-# the NEC IX; see README.md. Until then only clients that query 192.168.10.127
-# explicitly are affected, so this is safely reversible.
+# LAN 主 DNS 为 192.168.10.127，NEC IX 192.168.10.1 为备用。
+# DN42 条件转发经 VyOS，参见 README.md。
 
 ports:
   # These are the CONTAINER's listen addresses, so they must be unqualified —
@@ -35,6 +33,13 @@ conditional:
   # Queries for the AD zone go straight to the DC, which is authoritative. This
   # replaces the "DC first, router second" resolver ordering that clients use today.
   mapping:
+    # DN42 由 VyOS 使用注册地址转发，避免 LAN 私网源地址缺少回程。
+    dn42: 192.168.10.2
+    20.172.in-addr.arpa: 192.168.10.2
+    21.172.in-addr.arpa: 192.168.10.2
+    22.172.in-addr.arpa: 192.168.10.2
+    23.172.in-addr.arpa: 192.168.10.2
+    d.f.ip6.arpa: 192.168.10.2
     ad.ddupan.top: 192.168.10.5
     # Reverse lookups for LAN hosts — the DC holds the reverse zone.
     10.168.192.in-addr.arpa: 192.168.10.5

apps/gitea/README.md

@@ -44,3 +44,15 @@ API、OIDC、Git/Flux 和 runner 均已验证。第二跳按明确决定跳过
 结构，或者 release notes 指出相关 breaking migration 时，才恢复停机一致备份、分阶段
 suspend、详细日志审计和扩展验收。出现启动失败或 migration error 时也立即升级为完整
 故障流程。
+
+## Hydra 人类登录 PoC
+
+新增 `hydra` OIDC 登录源，旧 `authelia` 入口保留。Hydra 通过通用 OIDC Login/Consent
+适配器转到现有 Authelia 完成人类认证；不是 Gitea 直接验证 LDAP 或 SPIFFE。
+入口为 `https://git.ddupan.top/user/oauth2/hydra`，需 LAN/Tailscale 可达 Hydra 内网域名。
+
+新 client secret 通过 `ExternalSecret/gitea-hydra-oidc` 从 OpenBao 投射。沿用
+preferred_username、已验证邮箱与 groups；当前仍映射 gitea-admins，不在本轮切换组模型。
+先部署并验证 Hydra discovery 后再接入本配置，避免 Gitea init 因上游不可达而失败。
+
+实际登录验收与部署状态见 wiki；依赖和回退见 [Hydra README](../hydra/README.md)。

apps/gitea/gitea-values.yaml

@@ -116,6 +116,13 @@ gitea:
       scopes: openid profile email groups
       groupClaimName: groups
       adminGroup: gitea-admins
+    - name: hydra
+      provider: openidConnect
+      existingSecret: gitea-hydra-oidc
+      autoDiscoverUrl: https://hydra.ad.ddupan.top/.well-known/openid-configuration
+      scopes: openid profile email groups
+      groupClaimName: groups
+      adminGroup: gitea-admins
 
 persistence:
   size: 20Gi

apps/gitea/hydra-external-secret.yaml

@@ -0,0 +1,22 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: gitea-hydra-oidc
+  namespace: gitea
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: gitea-hydra-oidc
+    creationPolicy: Owner
+    template:
+      data:
+        key: gitea
+        secret: "{{ .client_secret }}"
+  data:
+    - secretKey: client_secret
+      remoteRef:
+        key: k8s/hydra
+        property: gitea_client_secret

apps/gitea/kustomization.yaml

@@ -16,3 +16,4 @@ resources:
   - helmrepository.yaml
   - helmrelease.yaml
   - httproute.yaml
+  - hydra-external-secret.yaml

apps/hydra/README.md

@@ -0,0 +1,102 @@
+# Hydra 与 OIDC Login/Consent PoC
+
+本目录提供独立 Hydra 签发服务，以及一个薄的 **OIDC 上游适配器**。当前上游配置为
+Authelia；适配器不连接 LDAP，也不管理用户目录。Samba AD、密码和 MFA 继续由现有
+Authelia 链路负责。第一轮只接入人类和 Gitea，不实现 agent 动态授权。
+
+```text
+Gitea → Hydra → OIDC Login/Consent → Authelia → Samba AD
+      ← OIDC ← 经验证的上游身份 ← OIDC callback
+```
+
+目标入口：
+
+- `https://hydra.ad.ddupan.top`：Hydra 公共 OAuth2/OIDC endpoint。
+- `https://hydra-login.ad.ddupan.top`：上游 OIDC 登录及 consent 适配器。
+- `hydra-admin.hydra.svc.cluster.local:4445`：仅集群内管理接口，无 HTTPRoute。
+
+均为 LAN/Tailscale 入口，复用 Envoy `eg/https` wildcard TLS。没有增加公网 tunnel。
+部署及实际验收状态以 wiki 和对应 PR 为准，文件存在不表示登录已验收。
+
+## 首次使用与边界
+
+在 Gitea 登录页选择 `hydra`，跳转到 Authelia 完成现有人类认证，再返回原有 Gitea
+账号。旧 `authelia` 登录源保留。Gitea 的账号关联和资源权限仍由 Gitea 维护。
+
+适配器要求验证上游 issuer、audience、签名、过期时间和 nonce，使用 PKCE S256，
+并把单次 state 绑定到 Secure/HttpOnly/SameSite=Lax cookie。短期登录事务只存内存，
+最多 1024 个、10 分钟过期；单副本重启后正在登录的用户需重试，不存人类密码或 token。
+
+Hydra subject 为上游 `(issuer, sub)` 的 SHA-256 加 `human:` 前缀，与可变邮箱/用户名
+分离。第一轮要求上游返回经过验证的 email 及 preferred_username；这些 claims 必须
+明确配置进 ID token。更换 issuer 会改变本 PoC 的 subject，正式迁移前需要身份绑定设计。
+
+仅为显式 `ALLOWED_CLIENTS=gitea` 自动 consent，scope 限于 openid/profile/email/groups；
+拒绝额外 access-token audience，不发 refresh token。只按实际请求 scope 释放 claims。
+这不是通用的无人确认授权服务。组当前透传，沿用 Gitea 的 gitea-admins 映射；统一组
+模型和 agent 认证均在后续阶段。不存在对 Authelia 专有协议的调用。
+
+NetworkPolicy 限制公共端口只接收 Envoy 流量，Hydra admin 只允许适配器访问。
+Hydra 使用正式模式，TLS 由 Envoy 终止；不使用 `--dev`。管理操作使用受控
+`kubectl port-forward`，不要将 admin 接口暴露到 Gateway。
+
+## 依赖、秘密与初始化
+
+依赖共享 CloudNativePG、OpenBao/ESO、Authelia OIDC、Envoy、Samba DNS、zot 镜像仓库。
+Hydra 使用独立 `hydra` database/role，不与其他应用共享数据库角色。
+
+`kv/k8s/hydra` 保存 dsn、system_secret、upstream_client_secret、upstream_client_digest、
+gitea_client_secret；通过 ExternalSecret 投射，值不写入 Git。Bootstrap 创建角色及数据库
+后才启动 Hydra migration。system_secret 必须持久保存，不得在重启时随机重建。
+
+Authelia 中新增 confidential client `hydra-login`：
+
+- redirect URI：`https://hydra-login.ad.ddupan.top/callback`；
+- authorization policy：two_factor；grant：authorization_code；PKCE：S256；
+- token endpoint auth：client_secret_basic；scope：openid/profile/email/groups；
+- claims policy：把 preferred_username、name、email、email_verified、groups 放入 ID token；
+- client secret 的 PBKDF2 digest 存入 Authelia，原值仅供适配器使用。
+
+Authelia 尚非 Flux 管理。修改 Helm values 时保留所有已有 clients 与 secret 引用，
+通过 `--reuse-values` 和最小 overlay 增加客户端，不能以本目录配置覆盖其完整 values。
+
+Hydra 中注册 confidential client `gitea`，redirect URI 为
+`https://git.ddupan.top/user/oauth2/hydra/callback`，grant/response 为 authorization_code/code，
+scope 为 openid/profile/email/groups，token endpoint auth 为 client_secret_basic。
+Gitea 启动时读取 OIDC discovery，所以应先确认 Hydra 健康和 discovery 可达，再接入 Gitea。
+
+## 构建与检查
+
+```bash
+cd apps/hydra/login-consent
+go test -race ./...
+go vet ./...
+CGO_ENABLED=0 go build -trimpath -ldflags='-s -w' -o login-consent .
+docker build -t hydra-login-consent:VERSION .
+```
+
+Go module 独立，依赖由 go.sum 锁定；Dockerfile 固定基础镜像 digest。
+使用已授权的短期 SPIFFE zot 凭据发布镜像，部署使用匿名拉取入口与不可变 digest。
+不把 registry 凭据写入源码或 build args。
+
+```bash
+kubectl kustomize apps/hydra
+sudo k3s kubectl -n hydra get deployment,pod,externalsecret,httproute
+sudo k3s kubectl -n hydra logs deployment/hydra -c migrate
+sudo k3s kubectl -n hydra logs deployment/hydra-login
+```
+
+日志不输出上游 token、授权 code、challenge 或秘密。登录失败先查两端 Pod 状态、
+DNS/discovery 连通性、client redirect URI 和 scope，再由用户重新发起登录。
+不要在故障排查中关闭签名验证、MFA 或 state/nonce 校验。
+
+## 恢复与回退
+
+保留共享 PostgreSQL 中 Hydra 数据及 OpenBao 秘密；数据库持有 clients、会话及签名密钥，
+单独重建 Deployment 不能替代恢复数据库。先恢复依赖，再启动 Hydra 和适配器。
+当前恢复仍依赖 homelab 共享基础设施，不能声称已完成独立灾备。
+
+第一轮不切换 Authelia 的主入口。撤回 Gitea 的新增 Hydra 登录源即可回到旧入口；
+先撤消费者，再考虑停用 Hydra。不要删除旧 Authelia 登录源、用户或数据库作为回退手段。
+
+跨服务设计见 [独立 IAM 草案](https://git.ddupan.top/panxiao81/homelab-wiki/src/branch/main/architecture/independent-iam-draft.md)。

apps/hydra/deployment.yaml

@@ -0,0 +1,95 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hydra
+  namespace: hydra
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: hydra
+  template:
+    metadata:
+      labels:
+        app: hydra
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      initContainers:
+      - name: migrate
+        image: docker.io/oryd/hydra:v26.2.0@sha256:ff67c7fb5f95074fa53374d41151713554960504b340cd3f95b09e65deaea2a9
+        args:
+        - migrate
+        - sql
+        - -e
+        - --yes
+        env:
+        - name: DSN
+          valueFrom:
+            secretKeyRef:
+              name: hydra
+              key: dsn
+        securityContext: &id002
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+        resources: &id001
+          requests:
+            cpu: 50m
+            memory: 64Mi
+          limits:
+            memory: 256Mi
+      containers:
+      - name: hydra
+        image: docker.io/oryd/hydra:v26.2.0@sha256:ff67c7fb5f95074fa53374d41151713554960504b340cd3f95b09e65deaea2a9
+        args:
+        - serve
+        - all
+        - --config
+        - /etc/hydra/hydra.yaml
+        - --sqa-opt-out
+        env:
+        - name: DSN
+          valueFrom:
+            secretKeyRef:
+              name: hydra
+              key: dsn
+        - name: SECRETS_SYSTEM
+          valueFrom:
+            secretKeyRef:
+              name: hydra
+              key: system_secret
+        ports:
+        - name: public
+          containerPort: 4444
+        - name: admin
+          containerPort: 4445
+        resources: *id001
+        securityContext: *id002
+        volumeMounts:
+        - name: config
+          mountPath: /etc/hydra
+          readOnly: true
+        readinessProbe:
+          httpGet:
+            path: /health/ready
+            port: admin
+          initialDelaySeconds: 5
+          periodSeconds: 5
+        livenessProbe:
+          httpGet:
+            path: /health/alive
+            port: admin
+          initialDelaySeconds: 20
+          periodSeconds: 20
+      volumes:
+      - name: config
+        configMap:
+          name: hydra-config

apps/hydra/external-secret.yaml

@@ -0,0 +1,16 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: hydra
+  namespace: hydra
+spec:
+  refreshInterval: 1h
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: openbao
+  target:
+    name: hydra
+    creationPolicy: Owner
+  dataFrom:
+  - extract:
+      key: k8s/hydra

apps/hydra/httproutes.yaml

@@ -0,0 +1,33 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: hydra-public
+  namespace: hydra
+spec:
+  parentRefs:
+  - name: eg
+    namespace: envoy-gateway-system
+    sectionName: https
+  hostnames:
+  - hydra.ad.ddupan.top
+  rules:
+  - backendRefs:
+    - name: hydra-public
+      port: 4444
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: hydra-login
+  namespace: hydra
+spec:
+  parentRefs:
+  - name: eg
+    namespace: envoy-gateway-system
+    sectionName: https
+  hostnames:
+  - hydra-login.ad.ddupan.top
+  rules:
+  - backendRefs:
+    - name: hydra-login
+      port: 8080

apps/hydra/hydra.yaml

@@ -0,0 +1,25 @@
+serve:
+  public:
+    port: 4444
+  admin:
+    port: 4445
+  tls:
+    allow_termination_from:
+    - 10.42.0.0/16
+  cookies:
+    same_site_mode: Lax
+urls:
+  self:
+    issuer: https://hydra.ad.ddupan.top
+    public: https://hydra.ad.ddupan.top
+  login: https://hydra-login.ad.ddupan.top/login
+  consent: https://hydra-login.ad.ddupan.top/consent
+ttl:
+  access_token: 15m
+  id_token: 15m
+  auth_code: 5m
+log:
+  level: info
+  leak_sensitive_values: false
+oauth2:
+  expose_internal_errors: false

apps/hydra/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- namespace.yaml
+- external-secret.yaml
+- deployment.yaml
+- login-deployment.yaml
+- services.yaml
+- httproutes.yaml
+- networkpolicy.yaml
+configMapGenerator:
+- name: hydra-config
+  namespace: hydra
+  files:
+  - hydra.yaml

apps/hydra/login-consent/.gitignore

@@ -0,0 +1 @@
+/login-consent

apps/hydra/login-consent/Dockerfile

@@ -0,0 +1,4 @@
+FROM gcr.io/distroless/static-debian12:nonroot@sha256:afa5c872c891853ca7fcf1f12c3edb23f7eeef36189728842dd51042ff57f7ab
+COPY login-consent /login-consent
+USER 65532:65532
+ENTRYPOINT ["/login-consent"]

apps/hydra/login-consent/go.mod

@@ -0,0 +1,13 @@
+module git.ddupan.top/panxiao81/homelab-infra/apps/hydra/login-consent
+
+go 1.26.0
+
+require (
+	github.com/coreos/go-oidc/v3 v3.14.1
+	golang.org/x/oauth2 v0.37.0
+)
+
+require (
+	github.com/go-jose/go-jose/v4 v4.0.5 // indirect
+	golang.org/x/crypto v0.36.0 // indirect
+)

apps/hydra/login-consent/go.sum

@@ -0,0 +1,18 @@
+github.com/coreos/go-oidc/v3 v3.14.1 h1:9ePWwfdwC4QKRlCXsJGou56adA/owXczOzwKdOumLqk=
+github.com/coreos/go-oidc/v3 v3.14.1/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
+github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
+github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/go-jose/go-jose/v4 v4.0.5 h1:M6T8+mKZl/+fNNuFHvGIzDz7BTLQPIounk/b9dw3AaE=
+github.com/go-jose/go-jose/v4 v4.0.5/go.mod h1:s3P1lRrkT8igV8D9OjyL4WRyHvjB6a4JSllnOrmmBOA=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/google/go-cmp v0.6.0/go.mod h1:17dUlkBOakJ0+DkrSSNjCkIjxS6bF9zb3elmeNGIjoY=
+github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
+github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOfJA=
+github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
+golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
+golang.org/x/oauth2 v0.37.0 h1:JUlcxA8oAtauLfiH8FX2/FkAWHAdi0QtGCGc+hofE98=
+golang.org/x/oauth2 v0.37.0/go.mod h1:IxwZNxUULJmpBFf9K/9NTMSIfZZuvuTy1gGxhigP/58=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

apps/hydra/login-consent/main.go

@@ -0,0 +1,285 @@
+// Login/Consent adapter for a single trusted upstream and first-party clients.
+package main
+
+import (
+	"bytes"
+	"context"
+	"crypto/rand"
+	"crypto/sha256"
+	"crypto/subtle"
+	"encoding/base64"
+	"encoding/hex"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"net/url"
+	"os"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/coreos/go-oidc/v3/oidc"
+	"golang.org/x/oauth2"
+)
+
+const cookieName = "__Host-hydra-login"
+
+type pending struct {
+	Challenge, Nonce, Verifier string
+	Expires                    time.Time
+}
+type claims struct {
+	Username      string   `json:"preferred_username"`
+	Email         string   `json:"email"`
+	EmailVerified bool     `json:"email_verified"`
+	Name          string   `json:"name"`
+	Groups        []string `json:"groups"`
+}
+type flowRequest struct {
+	Client struct {
+		ID string `json:"client_id"`
+	} `json:"client"`
+	Subject  string   `json:"subject"`
+	Scopes   []string `json:"requested_scope"`
+	Audience []string `json:"requested_access_token_audience"`
+	Context  claims   `json:"context"`
+}
+type app struct {
+	admin, public string
+	client        *http.Client
+	oauth         oauth2.Config
+	verifier      *oidc.IDTokenVerifier
+	allowed       map[string]bool
+	mu            sync.Mutex
+	pending       map[string]pending
+}
+
+func required(key string) string {
+	v := os.Getenv(key)
+	if v == "" {
+		log.Fatalf("missing %s", key)
+	}
+	return v
+}
+func random() string {
+	b := make([]byte, 32)
+	if _, err := rand.Read(b); err != nil {
+		panic(err)
+	}
+	return base64.RawURLEncoding.EncodeToString(b)
+}
+func (a *app) api(ctx context.Context, method, path string, in, out any) error {
+	var body io.Reader
+	if in != nil {
+		b, err := json.Marshal(in)
+		if err != nil {
+			return err
+		}
+		body = bytes.NewReader(b)
+	}
+	req, err := http.NewRequestWithContext(ctx, method, a.admin+path, body)
+	if err != nil {
+		return err
+	}
+	req.Header.Set("Content-Type", "application/json")
+	resp, err := a.client.Do(req)
+	if err != nil {
+		return errors.New("Hydra unavailable")
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return fmt.Errorf("Hydra status %d", resp.StatusCode)
+	}
+	if out != nil {
+		return json.NewDecoder(io.LimitReader(resp.Body, 1<<20)).Decode(out)
+	}
+	return nil
+}
+func (a *app) request(r *http.Request, kind, challenge string) (flowRequest, error) {
+	var f flowRequest
+	if challenge == "" || len(challenge) > 8192 {
+		return f, errors.New("missing or invalid challenge")
+	}
+	err := a.api(r.Context(), http.MethodGet, "/admin/oauth2/auth/requests/"+kind+"?"+kind+"_challenge="+url.QueryEscape(challenge), nil, &f)
+	if err != nil {
+		return f, err
+	}
+	if !a.allowed[f.Client.ID] {
+		return f, errors.New("client not allowed")
+	}
+	return f, nil
+}
+func (a *app) accept(w http.ResponseWriter, r *http.Request, kind, challenge string, body any) {
+	var result struct {
+		Redirect string `json:"redirect_to"`
+	}
+	if err := a.api(r.Context(), http.MethodPut, "/admin/oauth2/auth/requests/"+kind+"/accept?"+kind+"_challenge="+url.QueryEscape(challenge), body, &result); err != nil {
+		fail(w, 502)
+		return
+	}
+	// Only Hydra's own authorization endpoint can receive a challenge verifier.
+	u, err := url.Parse(result.Redirect)
+	p, _ := url.Parse(a.public)
+	if err != nil || u.Scheme != p.Scheme || u.Host != p.Host || u.User != nil || u.Path != "/oauth2/auth" {
+		fail(w, 502)
+		return
+	}
+	http.Redirect(w, r, result.Redirect, http.StatusSeeOther)
+}
+func fail(w http.ResponseWriter, status int) { http.Error(w, http.StatusText(status), status) }
+func (a *app) login(w http.ResponseWriter, r *http.Request) {
+	challenge := r.URL.Query().Get("login_challenge")
+	if _, err := a.request(r, "login", challenge); err != nil {
+		fail(w, 403)
+		return
+	}
+	state := random()
+	p := pending{challenge, random(), oauth2.GenerateVerifier(), time.Now().Add(10 * time.Minute)}
+	a.mu.Lock()
+	for k, v := range a.pending {
+		if time.Now().After(v.Expires) {
+			delete(a.pending, k)
+		}
+	}
+	if len(a.pending) >= 1024 {
+		a.mu.Unlock()
+		fail(w, 503)
+		return
+	}
+	a.pending[state] = p
+	a.mu.Unlock()
+	http.SetCookie(w, &http.Cookie{Name: cookieName, Value: state, Path: "/", Secure: true, HttpOnly: true, SameSite: http.SameSiteLaxMode, MaxAge: 600})
+	http.Redirect(w, r, a.oauth.AuthCodeURL(state, oidc.Nonce(p.Nonce), oauth2.S256ChallengeOption(p.Verifier)), http.StatusSeeOther)
+}
+func (a *app) take(r *http.Request) (pending, error) {
+	state := r.URL.Query().Get("state")
+	cookie, err := r.Cookie(cookieName)
+	if err != nil || state == "" || subtle.ConstantTimeCompare([]byte(cookie.Value), []byte(state)) != 1 {
+		return pending{}, errors.New("state mismatch")
+	}
+	a.mu.Lock()
+	defer a.mu.Unlock()
+	p, ok := a.pending[state]
+	delete(a.pending, state)
+	if !ok || time.Now().After(p.Expires) {
+		return pending{}, errors.New("expired or used state")
+	}
+	return p, nil
+}
+func (a *app) callback(w http.ResponseWriter, r *http.Request) {
+	p, err := a.take(r)
+	if err != nil {
+		fail(w, 403)
+		return
+	}
+	http.SetCookie(w, &http.Cookie{Name: cookieName, Path: "/", Secure: true, HttpOnly: true, SameSite: http.SameSiteLaxMode, MaxAge: -1})
+	if r.URL.Query().Get("error") != "" || r.URL.Query().Get("code") == "" {
+		fail(w, 403)
+		return
+	}
+	ctx := oidc.ClientContext(r.Context(), a.client)
+	token, err := a.oauth.Exchange(ctx, r.URL.Query().Get("code"), oauth2.VerifierOption(p.Verifier))
+	if err != nil {
+		fail(w, 502)
+		return
+	}
+	raw, ok := token.Extra("id_token").(string)
+	if !ok {
+		fail(w, 502)
+		return
+	}
+	id, err := a.verifier.Verify(ctx, raw)
+	if err != nil || id.Nonce != p.Nonce || id.Subject == "" {
+		fail(w, 403)
+		return
+	}
+	var c claims
+	if id.Claims(&c) != nil || c.Username == "" || c.Email == "" || !c.EmailVerified {
+		fail(w, 403)
+		return
+	}
+	if _, err := a.request(r, "login", p.Challenge); err != nil {
+		fail(w, 403)
+		return
+	}
+	// Stable identity is tied to the verified upstream issuer+subject, never email.
+	sum := sha256.Sum256([]byte(id.Issuer + "\x00" + id.Subject))
+	a.accept(w, r, "login", p.Challenge, map[string]any{"subject": "human:" + hex.EncodeToString(sum[:]), "remember": false, "context": c})
+}
+func consentSession(f flowRequest) (map[string]any, error) {
+	if !strings.HasPrefix(f.Subject, "human:") || f.Context.Username == "" || f.Context.Email == "" || !f.Context.EmailVerified {
+		return nil, errors.New("invalid identity context")
+	}
+	allowed := map[string]bool{"openid": true, "profile": true, "email": true, "groups": true}
+	session := map[string]any{"principal_type": "human"}
+	for _, scope := range f.Scopes {
+		if !allowed[scope] {
+			return nil, errors.New("scope not allowed")
+		}
+		switch scope {
+		case "profile":
+			session["preferred_username"] = f.Context.Username
+			session["name"] = f.Context.Name
+		case "email":
+			session["email"] = f.Context.Email
+			session["email_verified"] = true
+		case "groups":
+			session["groups"] = f.Context.Groups
+		}
+	}
+	if len(f.Audience) > 0 {
+		return nil, errors.New("access token audience not allowed")
+	}
+	return session, nil
+}
+func (a *app) consent(w http.ResponseWriter, r *http.Request) {
+	challenge := r.URL.Query().Get("consent_challenge")
+	f, err := a.request(r, "consent", challenge)
+	if err != nil {
+		fail(w, 403)
+		return
+	}
+	session, err := consentSession(f)
+	if err != nil {
+		fail(w, 403)
+		return
+	}
+	// Explicit policy for pre-approved first-party clients only; no generic auto-consent.
+	a.accept(w, r, "consent", challenge, map[string]any{"grant_scope": f.Scopes, "remember": false, "session": map[string]any{"id_token": session}})
+}
+func (a *app) handler() http.Handler {
+	mux := http.NewServeMux()
+	mux.HandleFunc("GET /healthz", func(w http.ResponseWriter, r *http.Request) { w.WriteHeader(200) })
+	mux.HandleFunc("GET /login", a.login)
+	mux.HandleFunc("GET /callback", a.callback)
+	mux.HandleFunc("GET /consent", a.consent)
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Cache-Control", "no-store")
+		w.Header().Set("Referrer-Policy", "no-referrer")
+		w.Header().Set("X-Content-Type-Options", "nosniff")
+		w.Header().Set("Content-Security-Policy", "default-src 'none'; frame-ancestors 'none'")
+		mux.ServeHTTP(w, r)
+	})
+}
+func main() {
+	client := &http.Client{Timeout: 15 * time.Second, CheckRedirect: func(r *http.Request, via []*http.Request) error { return http.ErrUseLastResponse }}
+	issuer := required("UPSTREAM_ISSUER")
+	ctx := oidc.ClientContext(context.Background(), client)
+	provider, err := oidc.NewProvider(ctx, issuer)
+	if err != nil {
+		log.Fatal("upstream discovery failed")
+	}
+	clientID := required("UPSTREAM_CLIENT_ID")
+	a := &app{admin: required("HYDRA_ADMIN_URL"), public: required("HYDRA_PUBLIC_URL"), client: client, allowed: map[string]bool{}, pending: map[string]pending{},
+		oauth:    oauth2.Config{ClientID: clientID, ClientSecret: required("UPSTREAM_CLIENT_SECRET"), RedirectURL: required("CALLBACK_URL"), Endpoint: provider.Endpoint(), Scopes: []string{"openid", "profile", "email", "groups"}},
+		verifier: provider.Verifier(&oidc.Config{ClientID: clientID})}
+	for _, id := range strings.Split(required("ALLOWED_CLIENTS"), ",") {
+		a.allowed[id] = true
+	}
+	s := http.Server{Addr: ":8080", Handler: a.handler(), ReadHeaderTimeout: 5 * time.Second, ReadTimeout: 20 * time.Second, WriteTimeout: 45 * time.Second, IdleTimeout: 60 * time.Second, MaxHeaderBytes: 16384}
+	log.Print("login/consent adapter listening on :8080")
+	log.Fatal(s.ListenAndServe())
+}

apps/hydra/login-consent/main_test.go

@@ -0,0 +1,107 @@
+package main
+
+import (
+	"encoding/json"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"strings"
+	"testing"
+	"time"
+
+	"golang.org/x/oauth2"
+)
+
+func TestStateBoundToCookieSingleUseAndExpiry(t *testing.T) {
+	a := &app{pending: map[string]pending{"valid": {Challenge: "challenge", Expires: time.Now().Add(time.Minute)}, "expired": {Expires: time.Now().Add(-time.Minute)}}}
+	request := func(state, cookie string) *http.Request {
+		r := httptest.NewRequest("GET", "https://login.example/callback?state="+state, nil)
+		if cookie != "" {
+			r.AddCookie(&http.Cookie{Name: cookieName, Value: cookie})
+		}
+		return r
+	}
+	for _, r := range []*http.Request{request("valid", ""), request("valid", "other"), request("expired", "expired")} {
+		if _, err := a.take(r); err == nil {
+			t.Fatal("invalid state accepted")
+		}
+	}
+	if p, err := a.take(request("valid", "valid")); err != nil || p.Challenge != "challenge" {
+		t.Fatal("valid state rejected")
+	}
+	if _, err := a.take(request("valid", "valid")); err == nil {
+		t.Fatal("replayed state accepted")
+	}
+}
+func TestConsentRejectsPrivilegeExpansionAndFiltersClaims(t *testing.T) {
+	f := flowRequest{Subject: "human:known", Scopes: []string{"openid", "email"}, Context: claims{Username: "alice", Email: "[email protected]", EmailVerified: true, Groups: []string{"operators"}}}
+	s, err := consentSession(f)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok := s["groups"]; ok {
+		t.Fatal("groups leaked without scope")
+	}
+	if _, ok := s["preferred_username"]; ok {
+		t.Fatal("profile leaked without scope")
+	}
+	for _, scope := range []string{"admin", "offline_access", "unknown"} {
+		bad := f
+		bad.Scopes = append([]string{"openid"}, scope)
+		if _, err := consentSession(bad); err == nil {
+			t.Fatalf("accepted %s", scope)
+		}
+	}
+	f.Audience = []string{"other-service"}
+	if _, err := consentSession(f); err == nil {
+		t.Fatal("unexpected audience accepted")
+	}
+	f.Audience = nil
+	f.Context.EmailVerified = false
+	if _, err := consentSession(f); err == nil {
+		t.Fatal("unverified email accepted")
+	}
+}
+func TestLoginValidatesClientAndUsesPKCEAndNonce(t *testing.T) {
+	admin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		json.NewEncoder(w).Encode(map[string]any{"client": map[string]string{"client_id": r.URL.Query().Get("login_challenge")}})
+	}))
+	defer admin.Close()
+	a := &app{admin: admin.URL, client: admin.Client(), allowed: map[string]bool{"gitea": true}, pending: map[string]pending{}, oauth: oauth2.Config{ClientID: "hydra-login", RedirectURL: "https://login.example/callback", Endpoint: oauth2.Endpoint{AuthURL: "https://upstream.example/authorize"}}}
+	w := httptest.NewRecorder()
+	a.handler().ServeHTTP(w, httptest.NewRequest("GET", "https://login.example/login?login_challenge=rogue", nil))
+	if w.Code != 403 {
+		t.Fatal("unknown client accepted")
+	}
+	w = httptest.NewRecorder()
+	a.handler().ServeHTTP(w, httptest.NewRequest("GET", "https://login.example/login?login_challenge=gitea", nil))
+	if w.Code != 303 {
+		t.Fatalf("status %d", w.Code)
+	}
+	u, _ := url.Parse(w.Header().Get("Location"))
+	q := u.Query()
+	if q.Get("code_challenge_method") != "S256" || q.Get("code_challenge") == "" || q.Get("nonce") == "" || q.Get("state") == "" {
+		t.Fatal("missing protocol binding")
+	}
+	cookies := w.Result().Cookies()
+	if len(cookies) != 1 || !cookies[0].Secure || !cookies[0].HttpOnly || cookies[0].SameSite != http.SameSiteLaxMode || cookies[0].Value != q.Get("state") {
+		t.Fatal("unsafe cookie")
+	}
+	if w.Header().Get("Cache-Control") != "no-store" {
+		t.Fatal("missing cache protection")
+	}
+}
+func TestHydraRedirectCannotLeaveTrustedOrigin(t *testing.T) {
+	for _, target := range []string{"https://evil.example/oauth2/auth", "https://[email protected]/oauth2/auth", "https://hydra.example/other"} {
+		admin := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			json.NewEncoder(w).Encode(map[string]string{"redirect_to": target})
+		}))
+		a := &app{admin: admin.URL, public: "https://hydra.example", client: admin.Client()}
+		w := httptest.NewRecorder()
+		a.accept(w, httptest.NewRequest("GET", "https://login.example/login", nil), "login", "challenge", map[string]string{"subject": "human:test"})
+		if w.Code != 502 || strings.Contains(w.Header().Get("Location"), "evil") {
+			t.Fatal("untrusted redirect accepted")
+		}
+		admin.Close()
+	}
+}

apps/hydra/login-deployment.yaml

@@ -0,0 +1,69 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hydra-login
+  namespace: hydra
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: hydra-login
+  template:
+    metadata:
+      labels:
+        app: hydra-login
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65532
+        runAsGroup: 65532
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: login-consent
+        image: zot.ad.ddupan.top/iam/oidc-login-consent@sha256:fede9b9e93c457c4b7a8a6022d9df86ff5d5900d3f6b6c4f3439851a0ae1e944
+        env:
+        - name: HYDRA_ADMIN_URL
+          value: http://hydra-admin.hydra.svc.cluster.local:4445
+        - name: HYDRA_PUBLIC_URL
+          value: https://hydra.ad.ddupan.top
+        - name: UPSTREAM_ISSUER
+          value: https://auth.ddupan.top
+        - name: UPSTREAM_CLIENT_ID
+          value: hydra-login
+        - name: CALLBACK_URL
+          value: https://hydra-login.ad.ddupan.top/callback
+        - name: ALLOWED_CLIENTS
+          value: gitea
+        - name: UPSTREAM_CLIENT_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: hydra
+              key: upstream_client_secret
+        ports:
+        - name: http
+          containerPort: 8080
+        resources:
+          requests:
+            cpu: 50m
+            memory: 64Mi
+          limits:
+            memory: 256Mi
+        securityContext:
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: http
+          initialDelaySeconds: 10

apps/hydra/namespace.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: hydra
+  labels:
+    pod-security.kubernetes.io/enforce: restricted

apps/hydra/networkpolicy.yaml

@@ -0,0 +1,46 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: hydra
+  namespace: hydra
+spec:
+  podSelector:
+    matchLabels:
+      app: hydra
+  policyTypes:
+  - Ingress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: envoy-gateway-system
+    ports:
+    - port: 4444
+      protocol: TCP
+  - from:
+    - podSelector:
+        matchLabels:
+          app: hydra-login
+    ports:
+    - port: 4445
+      protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: hydra-login
+  namespace: hydra
+spec:
+  podSelector:
+    matchLabels:
+      app: hydra-login
+  policyTypes:
+  - Ingress
+  ingress:
+  - from:
+    - namespaceSelector:
+        matchLabels:
+          kubernetes.io/metadata.name: envoy-gateway-system
+    ports:
+    - port: 8080
+      protocol: TCP

apps/hydra/services.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: hydra-public
+  namespace: hydra
+spec:
+  selector:
+    app: hydra
+  ports:
+  - port: 4444
+    targetPort: 4444
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hydra-admin
+  namespace: hydra
+spec:
+  selector:
+    app: hydra
+  ports:
+  - port: 4445
+    targetPort: 4445
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hydra-login
+  namespace: hydra
+spec:
+  selector:
+    app: hydra-login
+  ports:
+  - port: 8080
+    targetPort: 8080

apps/netbox/terraform/topology.yml

@@ -52,11 +52,16 @@ prefix_roles:
 # range. It makes the collision VISIBLE — the range shows 100% utilised and the
 # address never appears as a suggestion — where plain YAML shows nothing at all.
 ip_ranges:
-  - start: 192.168.10.10/24
+  - start: 192.168.10.128/24
     end: 192.168.10.250/24
     status: active
     mark_utilized: true
-    description: "NEC IX DHCP pool — do NOT statically allocate inside this."
+    description: "NEC IX DHCP pool, updated 2026-09-14. Do NOT statically allocate inside this."
+  - start: 192.168.10.251/24
+    end: 192.168.10.254/24
+    status: reserved
+    mark_utilized: true
+    description: "用户确认预留，尚未分配；不可按扫描无响应视为空闲。"
 
 vlan_group:
   name: lab
@@ -144,8 +149,8 @@ devices:
     role: hypervisor
     type: 10vgcto1ww
     serial: PC1AGX1Q
-    description: "Proxmox VE 9.2. LINSTOR satellite. The node that randomly froze."
-    comments: "AMD Ryzen 5 PRO 2400GE w/ Vega, 8 threads, 7 GiB RAM. BIOS M1XKT45A. Raven Ridge idle bug fixed in BIOS: Power Supply Idle Control = Typical Current Idle."
+    description: "Proxmox VE 9.2. LINSTOR satellite."
+    comments: "AMD Ryzen 5 PRO 2400GE w/ Vega, 8 threads, 7 GiB RAM. BIOS M1XKT45A."
     interfaces:
       - { name: vmbr0, type: bridge, ip: 192.168.10.7/24, primary: true, mtu: 9000, dns_name: pve2.ad.ddupan.top }
 
@@ -154,7 +159,7 @@ devices:
     type: 10vgcto1ww
     serial: PC1AGX1P
     description: "Proxmox VE 9.2. LINSTOR satellite."
-    comments: "AMD Ryzen 5 PRO 2400GE w/ Vega, 8 threads, 7 GiB RAM. BIOS M1XKT55A. Same silicon as pve2, so susceptible to the same idle bug in principle."
+    comments: "AMD Ryzen 5 PRO 2400GE w/ Vega, 8 threads, 7 GiB RAM. BIOS M1XKT55A."
     interfaces:
       - { name: vmbr0, type: bridge, ip: 192.168.10.9/24, primary: true, mtu: 9000, dns_name: pve3.ad.ddupan.top }
 
@@ -181,9 +186,8 @@ devices:
   # Wi-Fi. Runs as an AP/bridge, not a router — the NEC IX is the gateway, so this box's
   # routing, NAT and DHCP are not in play. Wireless clients land directly on the flat LAN.
   #
-  # ⚠ Its address .10 is the FIRST ADDRESS OF THE DHCP POOL above. Either it holds a lease
-  # (so the address can move) or it is a static that overlaps the pool. NetBox surfaces
-  # the overlap; the underlying config still needs a decision. See ../README.md.
+  # 2026-09-14: NEC IX 为此 MAC 固定分配 .10；动态池已迁到 .128–.250。
+  # 操作与回滚记录：infrastructure/samba-ad/router-dhcp-nec-ix.md。
   #
   # Identified by MAC OUI d4:2c:46 = BUFFALO.INC plus the model string on its login page.
   - name: ap-buffalo

apps/nexus/README.md

@@ -0,0 +1,157 @@
+# Nexus Repository POC
+
+本目录声明一个 Nexus Repository Community Edition POC，用来验证一次性 CI runner 通过
+网络服务复用 Ansible Galaxy、Go Modules 与 OCI/BuildKit 缓存。Nexus 固定为 `3.96.1`，
+镜像固定到官方 multi-arch index digest；LAN 入口为
+`https://nexus.ad.ddupan.top`。
+
+## POC 边界
+
+- 单副本 Deployment，`Recreate` 更新，避免一个 RWO 卷被两个 Pod 同时挂载。
+- `/nexus-data` 使用 `localpv-zfs-ceph` 上的 50 GiB RWO PVC。
+- 资源预算为 250m/2 GiB request、2 CPU/4 GiB limit；JVM heap 上限 2 GiB。
+- 使用容器默认的 embedded H2。它只用于 POC；正式接管 OCI 制品前必须迁移到外部
+  PostgreSQL，并验证备份恢复。
+- 入口只在 LAN wildcard Gateway 上发布，不创建公网 DNS 或 Cloudflare route。
+- 不套 Authelia forward-auth；它会破坏 Go、Ansible 与 OCI 非浏览器客户端。
+- 现有 zot 保持不变。Nexus 完成 OCI、BuildKit cache 和恢复验收前不得迁移或删除 zot。
+
+Terraform provider 创建 `ansible-public`、`go-public`、最小匿名权限与 OCI Bearer Token
+Realm。Nexus 3.94 才加入的原生 OCI repository 已有 REST API，但当前锁定的 community
+provider 尚未暴露 OCI resource；`terraform/reconcile-oci.sh` 因此根据 3.96.1 实例 Swagger
+固定的 JSON schema，幂等调和 `oci-hosted`、`oci-proxy` 与 `oci-public`。不得绕过该入口在
+UI 中创建无人管理的长期 repository。
+
+## 部署
+
+Flux 从 `clusters/homelab/apps/nexus.yaml` 协调本目录，并依赖 Envoy Gateway 与 OpenEBS。
+合并前只渲染配置，不直接 apply：
+
+```bash
+kubectl kustomize apps/nexus
+```
+
+合并并由 Flux 部署后检查：
+
+```bash
+kubectl -n flux-system get kustomization nexus
+kubectl -n nexus get pod,pvc,service,httproute
+kubectl -n nexus logs deployment/nexus --tail=100
+```
+
+启动可能需要数分钟，startup probe 允许最多十分钟。不要因初次启动较慢反复删除 Pod；
+先确认 PVC 已 Bound、Pod 没有 OOM，以及日志仍在推进。
+
+DNS 期望状态已加入 `infrastructure/dns/records.yml`，需从 Samba AD Ansible root 以
+`--check --diff` 核对后再按其 README 应用 DNS tag。没有 DNS 时可先用 port-forward
+验证应用，但不能据此宣称 Gateway 路径已通过。
+
+## 首次初始化与 Terraform
+
+初始管理员密码生成在 PVC 的 `/nexus-data/admin.password`。只在交互式终端中读取并立即
+完成首次密码轮换；不得把密码复制进 shell tracing、工单、Git 或命令参数。随后将
+Terraform 管理账号的凭据存入 OpenBao，由 CI 通过 Terraform input variable 注入以下
+环境变量：
+
+```text
+TF_VAR_nexus_url=https://nexus.ad.ddupan.top
+TF_VAR_nexus_username=admin
+TF_VAR_nexus_password=<OpenBao kv/infra/nexus 的 admin_password 字段>
+```
+
+`terraform/` 使用 `sonatype-nexus-community/sonatyperepo` 1.17.0，当前声明：
+
+- `ansible-galaxy-proxy` → `https://galaxy.ansible.com`
+- `ansible-public` group
+- `go-proxy` → `https://proxy.golang.org`
+- `go-public` group
+
+provider credential 不写入 HCL 或 tfvars。正式 apply 前还必须为这个独立 Terraform root
+配置远端 backend；本地 state 只允许用于可丢弃的 POC，不提交。验证命令：
+
+```bash
+terraform -chdir=apps/nexus/terraform init -backend=false
+terraform -chdir=apps/nexus/terraform validate
+```
+
+先以 `--check` 查看 OCI repository 漂移，再明确 apply；脚本只从上述环境变量取得凭据，
+用临时 `0600` netrc 调用 REST API，退出时删除：
+
+```bash
+apps/nexus/terraform/reconcile-oci.sh --check
+apps/nexus/terraform/reconcile-oci.sh --apply
+```
+
+Terraform 同时把内置 `anonymous` 用户从默认的全仓库 `nx-anonymous` 角色收窄到
+`ansible-public`、其返回制品 URL 使用的 `ansible-galaxy-proxy`、`go-public`，以及
+`oci-public`/`oci-proxy` 的 `browse/read` 权限。`oci-hosted` 不向匿名用户开放。首次接管
+已有实例时先执行
+`terraform import sonatyperepo_user.anonymous anonymous,default`，再 apply；不要先启用默认的
+全仓库匿名读取。
+
+2026-09-20 的 POC 现场验收已确认：Flux 与 Pod Ready、PVC Bound、HTTPRoute 通过 HTTPS
+返回 Nexus 状态 200，Samba DNS 已幂等收敛。全新客户端目录通过匿名入口下载
+`community.general:11.2.0` 时冷缓存为 8.49 秒、热缓存为 1.89 秒，两次 tarball SHA-256
+一致；`golang.org/x/[email protected]` 为 2.92 秒与 1.51 秒。
+
+## 客户端验收
+
+先验证冷缓存，再原样重复命令验证热缓存；记录 Nexus 请求、上游流量和耗时，不只观察
+命令成功。Ansible 配置的 URL 必须以 `/` 结尾：
+
+```ini
+[galaxy]
+server_list = nexus
+
+[galaxy_server.nexus]
+url = https://nexus.ad.ddupan.top/repository/ansible-public/
+```
+
+```bash
+ansible-galaxy collection install -r collections/requirements.yml \
+  -p .ansible/collections
+```
+
+Go POC 使用：
+
+```bash
+GOPROXY=https://nexus.ad.ddupan.top/repository/go-public/ go mod download
+```
+
+私有 `git.ddupan.top/*` module 的 `GOPRIVATE`、凭据与是否允许 `direct` fallback 在实际
+workflow 中单独决定；不要让私有 module path 意外发往公共 proxy。
+
+OCI 使用 path-based routing：匿名公共拉取地址形如
+`nexus.ad.ddupan.top/oci-public/library/alpine:3.22`，认证写入地址形如
+`nexus.ad.ddupan.top/oci-hosted/<namespace>/<image>:<tag>`。2026-09-20 现场验收结果：
+
+- `oci-public` 匿名代理拉取 Alpine 冷缓存 4.75 秒、热缓存 0.80 秒，digest 一致；
+- `oci-hosted` 认证 push/pull 成功，匿名 pull 返回 401；
+- amd64/arm64 OCI image index push 成功，两个平台 manifest 可见；
+- Helm chart push/pull digest 与本地 tarball SHA-256 一致；
+- Cosign 3.1.3 使用一次性密钥签名并验证成功，OCI 1.1 referrers API 返回一个
+  `application/vnd.dev.sigstore.bundle.v0.3+json` artifact；
+- BuildKit `registry` cache 以 `mode=max` 导出成功，销毁首个 builder 后由新 builder 导入，
+  两个 `RUN` step 均明确命中 `CACHED`。
+
+本机安装的测试客户端包括 `/usr/local/bin/cosign` 3.1.3；安装时核对官方 Linux amd64
+binary SHA-256 `4629c757b7618056f8ddd7e2625ae9fdd94c0372a65049520bc7d9df9efc7f71`。
+上述结果仍不代表备份恢复、外部 PostgreSQL 或正式 publisher service account 已完成；
+这些项目通过前不得迁移或删除 zot。
+
+## 数据与恢复
+
+POC 的数据库、配置、blob、初始管理员状态都位于 `nexus-data` PVC。删除 Deployment
+不会删除 PVC；删除 PVC 会永久删除整个 POC。当前没有独立备份，不能将它用于唯一副本的
+正式制品。
+
+恢复验证至少包括：停止写入、取得一致备份、在独立 PVC/实例恢复、登录、列出 repository、
+拉取已缓存的 Ansible/Go 制品，并核对 OCI digest/referrers。正式化时再把数据库迁移至
+外部 PostgreSQL，并分别定义数据库与 blob 的备份、恢复顺序和 RPO。
+
+参考：
+
+- [Nexus OCI repositories](https://help.sonatype.com/en/oci-repositories.html)
+- [Nexus Ansible repositories](https://help.sonatype.com/en/ansible-repositories.html)
+- [Nexus Go repositories](https://help.sonatype.com/en/go-repositories.html)
+- [官方容器镜像](https://hub.docker.com/r/sonatype/nexus3)

apps/nexus/deployment.yaml

@@ -0,0 +1,82 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nexus
+  namespace: nexus
+  labels:
+    app.kubernetes.io/name: nexus
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: nexus
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: nexus
+    spec:
+      automountServiceAccountToken: false
+      securityContext:
+        fsGroup: 200
+        fsGroupChangePolicy: OnRootMismatch
+        runAsGroup: 200
+        runAsNonRoot: true
+        runAsUser: 200
+        seccompProfile:
+          type: RuntimeDefault
+      terminationGracePeriodSeconds: 120
+      containers:
+        - name: nexus
+          image: docker.io/sonatype/nexus3:3.96.1@sha256:56142f13432cf072e017aebb2025f201e42ae36ff40bb82618c702504c61f7dd
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: INSTALL4J_ADD_VM_PARAMS
+              value: >-
+                -Xms1024m -Xmx2048m -XX:MaxDirectMemorySize=1024m
+                -Djava.util.prefs.userRoot=/nexus-data/javaprefs
+          ports:
+            - name: http
+              containerPort: 8081
+              protocol: TCP
+          resources:
+            requests:
+              cpu: 250m
+              memory: 2Gi
+            limits:
+              cpu: "2"
+              memory: 4Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          startupProbe:
+            httpGet:
+              path: /service/rest/v1/status
+              port: http
+            failureThreshold: 60
+            periodSeconds: 10
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /service/rest/v1/status
+              port: http
+            failureThreshold: 6
+            periodSeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /service/rest/v1/status
+              port: http
+            failureThreshold: 6
+            periodSeconds: 30
+            timeoutSeconds: 5
+          volumeMounts:
+            - name: data
+              mountPath: /nexus-data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: nexus-data

apps/nexus/httproute.yaml

@@ -0,0 +1,16 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: nexus
+  namespace: nexus
+spec:
+  parentRefs:
+    - name: eg
+      namespace: envoy-gateway-system
+      sectionName: https
+  hostnames:
+    - nexus.ad.ddupan.top
+  rules:
+    - backendRefs:
+        - name: nexus
+          port: 8081

apps/nexus/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - httproute.yaml
+  - networkpolicy.yaml

apps/nexus/namespace.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nexus
+  labels:
+    pod-security.kubernetes.io/enforce: restricted
+    pod-security.kubernetes.io/audit: restricted
+    pod-security.kubernetes.io/warn: restricted

apps/nexus/networkpolicy.yaml

@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: nexus-ingress
+  namespace: nexus
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: nexus
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: envoy-gateway-system
+          podSelector:
+            matchLabels:
+              gateway.envoyproxy.io/owning-gateway-name: eg
+              gateway.envoyproxy.io/owning-gateway-namespace: envoy-gateway-system
+      ports:
+        - protocol: TCP
+          port: 8081

apps/nexus/pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nexus-data
+  namespace: nexus
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 50Gi
+  storageClassName: localpv-zfs-ceph

apps/nexus/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nexus
+  namespace: nexus
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: nexus
+  ports:
+    - name: http
+      port: 8081
+      protocol: TCP
+      targetPort: http

apps/nexus/terraform/.gitignore

@@ -0,0 +1,6 @@
+.terraform/
+*.tfstate
+*.tfstate.*
+*.tfplan
+crash.log
+crash.*.log

apps/nexus/terraform/.terraform.lock.hcl

@@ -0,0 +1,24 @@
+# This file is maintained automatically by "terraform init".
+# Manual edits may be lost in future updates.
+
+provider "registry.terraform.io/sonatype-nexus-community/sonatyperepo" {
+  version     = "1.17.0"
+  constraints = "1.17.0"
+  hashes = [
+    "h1:uKhvhhhI7B+HBsh0zq/ybqKt+EnOGyI6rjcRCtj79ZA=",
+    "zh:0dde99e7b343fa01f8eefc378171fb8621bedb20f59157d6cc8e3d46c738105f",
+    "zh:3315929df254a3a6ac27c8c846c2006f7d2a91fadc014351bc4d617f948e5bf9",
+    "zh:36be5a455af3ce4e187de26753de63e78c1ee9a32dba0135c6cf96a6c1fff25f",
+    "zh:3f73f7ff57b8c339a7c7ac37653e2dc0b2dd9dcc3f3a538788e7e3ac838337b2",
+    "zh:40286ecca4c22ab7ae90618ac6d2743f5055199dac81cf5204a4a397c784d439",
+    "zh:4d24e5c0195fb3155b1967583ee64cfeda402d7cc7f3c73369438f6c69f4245b",
+    "zh:828a9d7aceaac36af7f9c07af43ec8d20a89148780645d170ffb1c68b2da792d",
+    "zh:a5ab04de3fe626ec57c832618c6f990abd6610f81e132621651e0b180b970cff",
+    "zh:a959fa6090a8c0f53739879184e7346423494aee598003df0d1ab4a22b2eee91",
+    "zh:bdda26c2f03f918bbe59e75abea44868fafda019c3a543725331195df126350b",
+    "zh:d8048e149ee97ba62971e6a79355d59887bc6d10fcf72cc2feff3d0a2582670c",
+    "zh:dd36f9988af4e1ca5b1ca7b7bb6f658df9a220dfcda7fec7392fedfe9064f652",
+    "zh:dda2688d46c7e539fe97e8fe9d3ec81fb364170e018d9c6a681364c8955d4e9d",
+    "zh:e6b519afe2dea1c0434f766eb6bc9ba78cc5b6ef2c311c2ca3c65cb24744f31f",
+  ]
+}

apps/nexus/terraform/oci/oci-hosted.json

@@ -0,0 +1,17 @@
+{
+  "name": "oci-hosted",
+  "online": true,
+  "storage": {
+    "blobStoreName": "default",
+    "strictContentTypeValidation": true,
+    "writePolicy": "ALLOW",
+    "latestPolicy": false
+  },
+  "oci": {
+    "v1Enabled": false,
+    "forceBasicAuth": false,
+    "pathEnabled": true
+  },
+  "component": { "proprietaryComponents": false },
+  "cosign": { "enforcement": "NONE" }
+}

apps/nexus/terraform/oci/oci-proxy.json

@@ -0,0 +1,27 @@
+{
+  "name": "oci-proxy",
+  "online": true,
+  "storage": {
+    "blobStoreName": "default",
+    "strictContentTypeValidation": true
+  },
+  "oci": {
+    "v1Enabled": false,
+    "forceBasicAuth": false,
+    "pathEnabled": true
+  },
+  "ociProxy": {
+    "indexType": "HUB",
+    "cacheForeignLayers": false,
+    "foreignLayerUrlWhitelist": []
+  },
+  "proxy": {
+    "remoteUrl": "https://registry-1.docker.io",
+    "contentMaxAge": 1440,
+    "metadataMaxAge": 60,
+    "preserveEncodedCharacters": false
+  },
+  "negativeCache": { "enabled": true, "timeToLive": 60 },
+  "httpClient": { "blocked": false, "autoBlock": true },
+  "cosign": { "enforcement": "NONE" }
+}

apps/nexus/terraform/oci/oci-public.json

@@ -0,0 +1,15 @@
+{
+  "name": "oci-public",
+  "online": true,
+  "storage": {
+    "blobStoreName": "default",
+    "strictContentTypeValidation": true
+  },
+  "group": { "memberNames": ["oci-proxy"] },
+  "oci": {
+    "v1Enabled": false,
+    "forceBasicAuth": false,
+    "pathEnabled": true
+  },
+  "cosign": { "enforcement": "NONE" }
+}

apps/nexus/terraform/reconcile-oci.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+mode="${1:---check}"
+case "$mode" in
+  --check | --apply) ;;
+  *) echo "usage: $0 [--check|--apply]" >&2; exit 2 ;;
+esac
+
+: "${TF_VAR_nexus_url:?set TF_VAR_nexus_url}"
+: "${TF_VAR_nexus_username:?set TF_VAR_nexus_username}"
+: "${TF_VAR_nexus_password:?set TF_VAR_nexus_password}"
+
+script_dir="$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)"
+auth_file="$(mktemp /tmp/nexus-oci-auth.XXXXXX)"
+trap 'rm -f -- "$auth_file"' EXIT
+chmod 0600 "$auth_file"
+printf 'machine %s\nlogin %s\npassword %s\n' \
+  "${TF_VAR_nexus_url#*://}" "$TF_VAR_nexus_username" \
+  "$TF_VAR_nexus_password" >"$auth_file"
+
+drift=0
+for entry in \
+  "hosted:$script_dir/oci/oci-hosted.json" \
+  "proxy:$script_dir/oci/oci-proxy.json" \
+  "group:$script_dir/oci/oci-public.json"; do
+  repository_type="${entry%%:*}"
+  desired_file="${entry#*:}"
+  repository_name="$(jq -er '.name' "$desired_file")"
+  endpoint="$TF_VAR_nexus_url/service/rest/v1/repositories/oci/$repository_type"
+  current_file="$(mktemp /tmp/nexus-oci-current.XXXXXX)"
+
+  status="$(curl --silent --show-error --netrc-file "$auth_file" \
+    --output "$current_file" --write-out '%{http_code}' \
+    "$endpoint/$repository_name")"
+
+  if [[ "$status" == 404 ]]; then
+    drift=1
+    if [[ "$mode" == --apply ]]; then
+      curl --fail --silent --show-error --netrc-file "$auth_file" \
+        --header 'Content-Type: application/json' \
+        --data-binary "@$desired_file" "$endpoint"
+      echo "created $repository_name"
+    else
+      echo "missing $repository_name" >&2
+    fi
+  elif [[ "$status" == 200 ]]; then
+    if jq -e --slurpfile desired "$desired_file" '
+      def subset($actual; $wanted):
+        if ($wanted | type) == "object" then
+          all($wanted | keys[];
+            ($actual[.] != null) and subset($actual[.]; $wanted[.]))
+        else
+          $actual == $wanted
+        end;
+      subset(.; $desired[0])
+    ' "$current_file" >/dev/null; then
+      echo "in sync $repository_name"
+    else
+      drift=1
+      if [[ "$mode" == --apply ]]; then
+        curl --fail --silent --show-error --netrc-file "$auth_file" \
+          --request PUT --header 'Content-Type: application/json' \
+          --data-binary "@$desired_file" "$endpoint/$repository_name"
+        echo "updated $repository_name"
+      else
+        echo "drifted $repository_name" >&2
+      fi
+    fi
+  else
+    cat "$current_file" >&2
+    echo "unexpected HTTP $status for $repository_name" >&2
+    exit 1
+  fi
+  rm -f -- "$current_file"
+done
+
+if [[ "$mode" == --check && "$drift" -ne 0 ]]; then
+  exit 1
+fi

apps/nexus/terraform/repositories.tf

@@ -0,0 +1,64 @@
+locals {
+  proxy_http_client = {
+    auto_block = true
+    blocked    = false
+  }
+
+  proxy_negative_cache = {
+    enabled      = true
+    time_to_live = 60
+  }
+
+  repository_storage = {
+    blob_store_name                = "default"
+    strict_content_type_validation = true
+  }
+}
+
+resource "sonatyperepo_repository_ansiblegalaxy_proxy" "galaxy" {
+  name   = "ansible-galaxy-proxy"
+  online = true
+
+  http_client    = local.proxy_http_client
+  negative_cache = local.proxy_negative_cache
+  proxy = {
+    remote_url       = "https://galaxy.ansible.com"
+    content_max_age  = 1440
+    metadata_max_age = 60
+  }
+  storage = local.repository_storage
+}
+
+resource "sonatyperepo_repository_ansiblegalaxy_group" "public" {
+  name   = "ansible-public"
+  online = true
+
+  group = {
+    member_names = [sonatyperepo_repository_ansiblegalaxy_proxy.galaxy.name]
+  }
+  storage = local.repository_storage
+}
+
+resource "sonatyperepo_repository_go_proxy" "public" {
+  name   = "go-proxy"
+  online = true
+
+  http_client    = local.proxy_http_client
+  negative_cache = local.proxy_negative_cache
+  proxy = {
+    remote_url       = "https://proxy.golang.org"
+    content_max_age  = 1440
+    metadata_max_age = 60
+  }
+  storage = local.repository_storage
+}
+
+resource "sonatyperepo_repository_go_group" "public" {
+  name   = "go-public"
+  online = true
+
+  group = {
+    member_names = [sonatyperepo_repository_go_proxy.public.name]
+  }
+  storage = local.repository_storage
+}

apps/nexus/terraform/security.tf

@@ -0,0 +1,75 @@
+resource "sonatyperepo_privilege_repository_view" "anonymous_ansible" {
+  name        = "ci-anonymous-ansible-read"
+  description = "Anonymous read access to the Ansible Galaxy group"
+  actions     = ["BROWSE", "READ"]
+  format      = "ansiblegalaxy"
+  repository  = sonatyperepo_repository_ansiblegalaxy_group.public.name
+}
+
+resource "sonatyperepo_privilege_repository_view" "anonymous_ansible_proxy" {
+  name        = "ci-anonymous-ansible-proxy-read"
+  description = "Anonymous artifact read access to the Ansible Galaxy proxy"
+  actions     = ["BROWSE", "READ"]
+  format      = "ansiblegalaxy"
+  repository  = sonatyperepo_repository_ansiblegalaxy_proxy.galaxy.name
+}
+
+resource "sonatyperepo_privilege_repository_view" "anonymous_go" {
+  name        = "ci-anonymous-go-read"
+  description = "Anonymous read access to the Go module group"
+  actions     = ["BROWSE", "READ"]
+  format      = "go"
+  repository  = sonatyperepo_repository_go_group.public.name
+}
+
+resource "sonatyperepo_privilege_repository_view" "anonymous_oci_public" {
+  name        = "ci-anonymous-oci-public-read"
+  description = "Anonymous read access to the public OCI group"
+  actions     = ["BROWSE", "READ"]
+  format      = "oci"
+  repository  = "oci-public"
+}
+
+resource "sonatyperepo_privilege_repository_view" "anonymous_oci_proxy" {
+  name        = "ci-anonymous-oci-proxy-read"
+  description = "Anonymous read access to the OCI proxy member"
+  actions     = ["BROWSE", "READ"]
+  format      = "oci"
+  repository  = "oci-proxy"
+}
+
+resource "sonatyperepo_role" "anonymous_ci" {
+  id          = "ci-anonymous-read"
+  name        = "CI anonymous read"
+  description = "Read-only access to public CI dependency proxy groups"
+  privileges = [
+    sonatyperepo_privilege_repository_view.anonymous_ansible.name,
+    sonatyperepo_privilege_repository_view.anonymous_ansible_proxy.name,
+    sonatyperepo_privilege_repository_view.anonymous_go.name,
+    sonatyperepo_privilege_repository_view.anonymous_oci_public.name,
+    sonatyperepo_privilege_repository_view.anonymous_oci_proxy.name,
+  ]
+  roles = []
+}
+
+resource "sonatyperepo_user" "anonymous" {
+  user_id       = "anonymous"
+  first_name    = "Anonymous"
+  last_name     = "User"
+  email_address = "[email protected]"
+  status        = "active"
+  roles         = [sonatyperepo_role.anonymous_ci.id]
+}
+
+resource "sonatyperepo_system_anonymous_access" "ci" {
+  enabled    = true
+  user_id    = sonatyperepo_user.anonymous.user_id
+  realm_name = "NexusAuthorizingRealm"
+}
+
+resource "sonatyperepo_security_realms" "active" {
+  active = [
+    "NexusAuthenticatingRealm",
+    "OciBearerToken",
+  ]
+}

apps/nexus/terraform/versions.tf

@@ -0,0 +1,33 @@
+terraform {
+  required_version = ">= 1.11.0"
+
+  required_providers {
+    sonatyperepo = {
+      source  = "sonatype-nexus-community/sonatyperepo"
+      version = "1.17.0"
+    }
+  }
+}
+
+provider "sonatyperepo" {
+  url      = var.nexus_url
+  username = var.nexus_username
+  password = var.nexus_password
+}
+
+variable "nexus_url" {
+  description = "Nexus Repository base URL"
+  type        = string
+}
+
+variable "nexus_username" {
+  description = "Nexus Terraform management username"
+  type        = string
+  sensitive   = true
+}
+
+variable "nexus_password" {
+  description = "Nexus Terraform management password"
+  type        = string
+  sensitive   = true
+}

apps/ps3netsrv/docker-compose.yml

@@ -12,3 +12,10 @@ services:
       - "38008:38008"
     volumes:
       - "/mnt/pool/games/ps3:/games:rw"
+
+# 避免与 DN42 的 172.20.0.0/14 重叠。
+networks:
+  default:
+    ipam:
+      config:
+        - subnet: 172.28.1.0/24

apps/zot/values.yaml

@@ -70,11 +70,11 @@ configFiles:
         },
         "accessControl": {
           "repositories": {
-            "panxiao81/gitea-dynamic-runner-controller": {
+            "panxiao81/backstage": {
               "policies": [
                 {
                   "users": [
-                    "spiffe://ddupan.top/ci/panxiao81/gitea-dynamic-runner/publish-images",
+                    "spiffe://ddupan.top/ci/panxiao81/backstage/image",
                     "spiffe://ddupan.top/dev/panxiao81"
                   ],
                   "actions": [
@@ -88,18 +88,42 @@ configFiles:
                 "read"
               ]
             },
-            "panxiao81/gitea-dynamic-runner-runner": {
+            "panxiao81/gitea-dynamic-runner-controller": {
               "policies": [
                 {
                   "users": [
-                    "spiffe://ddupan.top/ci/panxiao81/gitea-dynamic-runner/publish-images",
-                    "spiffe://ddupan.top/dev/panxiao81"
+                    "spiffe://ddupan.top/ci/panxiao81/gitea-dynamic-runner/publish-images"
                   ],
                   "actions": [
                     "read",
                     "create",
                     "update"
                   ]
+                },
+                {
+                  "users": ["spiffe://ddupan.top/dev/panxiao81"],
+                  "actions": ["read", "create", "update", "delete"]
+                }
+              ],
+              "defaultPolicy": [
+                "read"
+              ]
+            },
+            "panxiao81/gitea-dynamic-runner-runner": {
+              "policies": [
+                {
+                  "users": [
+                    "spiffe://ddupan.top/ci/panxiao81/gitea-dynamic-runner/publish-images"
+                  ],
+                  "actions": [
+                    "read",
+                    "create",
+                    "update"
+                  ]
+                },
+                {
+                  "users": ["spiffe://ddupan.top/dev/panxiao81"],
+                  "actions": ["read", "create", "update", "delete"]
                 }
               ],
               "defaultPolicy": [

clusters/homelab/README.md

@@ -50,6 +50,9 @@ sudo k3s kubectl -n flux-system get gitrepositories,kustomizations
 - VictoriaMetrics Operator 已固定现有 chart `0.66.2` 并完成分阶段 Flux HelmRelease
   接管；Metrics、Logs、Traces 与 Grafana 也已统一完成 Flux 接管；
 - External Secrets Operator 已固定 chart `2.8.0` 并完成分阶段接管；
-- SPIRE 已按官方 hardened chart `0.30.2`（SPIRE `1.15.3`）声明，使用共享
+- SPIRE 已按 hardened chart 内部 fork `0.30.2-ddupan.1`（基于上游 `0.30.2`，SPIRE
+  `1.15.3`）声明，使用共享
   PostgreSQL 与独立 signing-key PVC；首次上线和 OpenBao JWT-SVID PoC 尚待合并后验证；
+- Nexus Repository CE POC 已加入 GitOps 声明，计划验证 Ansible Galaxy、Go Modules 与
+  OCI/BuildKit 缓存；尚未部署或完成现场验收，现有 zot 保持不变；
 - root Kustomization 与所有 brownfield 子 Kustomization 继续保持 `prune: false`。

clusters/homelab/apps/backstage.yaml

@@ -0,0 +1,22 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: backstage
+  namespace: flux-system
+spec:
+  dependsOn:
+    - name: envoy-gateway
+    - name: external-secrets
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: backstage
+      namespace: backstage
+  interval: 10m
+  path: ./apps/backstage
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  timeout: 5m
+  wait: true

clusters/homelab/apps/dynamic-runner.yaml

@@ -6,11 +6,12 @@ metadata:
 spec:
   dependsOn:
     - name: external-secrets
-    - name: nats
     - name: spire
   interval: 10m
   path: ./platform/dynamic-runner
-  prune: false
+  # The runner backends are replaceable. Prune is required when a retired
+  # worker is removed from the component; otherwise it keeps consuming work.
+  prune: true
   sourceRef:
     kind: GitRepository
     name: flux-system

clusters/homelab/apps/hydra.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: hydra
+  namespace: flux-system
+spec:
+  dependsOn:
+  - name: envoy-gateway
+  - name: external-secrets
+  interval: 10m
+  path: ./apps/hydra
+  prune: false
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  timeout: 5m
+  wait: true

clusters/homelab/apps/nexus.yaml

@@ -0,0 +1,22 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: nexus
+  namespace: flux-system
+spec:
+  dependsOn:
+    - name: envoy-gateway
+    - name: openebs
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: nexus
+      namespace: nexus
+  interval: 10m
+  path: ./apps/nexus
+  prune: false
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  timeout: 15m
+  wait: true

clusters/homelab/kustomization.yaml

@@ -7,7 +7,7 @@ resources:
   - apps/envoy-gateway.yaml
   - apps/external-secrets.yaml
   - apps/gitea.yaml
-  - apps/gitea-actions.yaml
+  - apps/backstage.yaml
   - apps/http-echo.yaml
   - apps/openebs.yaml
   - apps/nats.yaml
@@ -15,3 +15,5 @@ resources:
   - apps/spire.yaml
   - apps/observability.yaml
   - apps/zot.yaml
+  - apps/nexus.yaml
+  - apps/hydra.yaml

clusters/sandbox/README.md

@@ -0,0 +1,72 @@
+# Sandbox 集群
+
+这里是 OpenSandbox、CI 和 AI Agent workload 所在双节点 k3s 集群的 Flux
+reconciliation 入口。LXC、PostgreSQL、K3s、固定版本的 Flux controllers 与 root
+sync 由 `infrastructure/sandbox-cluster/` 中的 Ansible 管理；本目录只组合集群内
+workload。
+
+Flux 通过 `https://git.ddupan.top/panxiao81/homelab-infra.git` 读取公开仓库。
+Ansible 将 homelab CA 注入 `GitRepository/flux-system` 引用的同名 Secret，不使用
+长期 Git 凭据。root Kustomization 从 `./clusters/sandbox` 开始 reconciliation，
+初始保持 `prune: false`。
+
+Root bootstrap 已完成。后续按依赖顺序分别引入：
+
+1. 监控 CRD、kube-state-metrics 以及 kubelet/cAdvisor 抓取配置；
+2. SPIRE Agent、SPIFFE CSI Driver 与 workload registration；
+3. Kata Containers、`block-plain` RuntimeClass；
+4. 独立 External Secrets Operator 与 sandbox 专用 OpenBao auth backend；
+5. OpenSandbox controller/server；CI Pool 与 runner 调度器随后独立接入。
+
+每一阶段单独合并并等待对应 Flux Kustomization Ready，不在 bootstrap 时一次性部署。
+第一阶段监控拆为 `monitoring-operator` 与依赖它的 `monitoring`，防止 VM CR 在
+VictoriaMetrics Operator CRD Ready 前进入 reconciliation。
+
+SPIRE 阶段先由 `spire-bootstrap` 安装 CRD，并声明按上游 k8s_psat Server plugin
+要求收窄的 reviewer：它可以调用 TokenReview，并只读查询用于证明的 Pod 与 Node。
+Agent ServiceAccount 留给后续 HelmRelease 创建，避免两个声明方争夺同一资源。随后运行
+`infrastructure/sandbox-cluster/ansible/spire-bootstrap.yml`：playbook 从 sandbox
+读取 reviewer token，在内存中组成受限 kubeconfig，再通过 stdin reconcile 到 central
+集群的 `spire-server/spire-external-kubeconfigs` Secret。凭据不写入仓库、日志或控制机
+文件；该 Secret 准备完成后，才能启用 central external PSAT/controller-manager 和
+sandbox Agent/CSI。
+
+External controller-manager 使用独立的 `spire-controller-manager` ServiceAccount；其
+RBAC 与上游 controller-manager 所需权限一致，用于读取 workload selectors、维护
+SPIFFE CR status/finalizer 和 leader election。它不复用只允许 TokenReview 的 Server
+reviewer。Ansible 将两份 kubeconfig 写入同一个 central Secret 的不同 key，便于 central
+chart 分别绑定 `sandbox` 与 `sandbox-controller`。
+
+Central SPIRE Server 通过内网 `spire-server.ad.ddupan.top:8081` 接收 sandbox Agent
+attestation。Server 使用 external bundle publisher 持续维护 sandbox
+`spire-system/spire-bundle`，Agent 不固定或复制 trust bundle。Sandbox HelmRelease
+显式关闭 Server 与 OIDC Provider，只部署 Agent DaemonSet 和 SPIFFE CSI Driver；因此
+不会产生第二个 trust root。
+
+`spire-smoke` namespace、ServiceAccount 和 `sandbox-spire-smoke` ClusterSPIFFEID 只用于
+普通 Pod 的 CSI 回归夹具，稳定身份为 `spiffe://ddupan.top/sandbox/smoke`。Kata guest
+不能复用 node Agent 暴露的 Unix socket；virtio-fs 只能呈现 socket 路径，不能把连接
+跨过 VM 边界。Kata workload 必须使用 guest 内 Agent，具体约束见
+`platform/sandbox-kata/README.md`。测试 Pod 临时创建并在验收后删除，普通 Pod 的身份
+声明保留。
+
+Kata 阶段使用官方 4.1.0 `kata-deploy` chart 的短生命周期 `job` 模式，逐节点安装并
+重启 K3s。只启用 `kata-clh-runtime-rs`，不创建默认 `kata` 别名；该 handler 的
+`emptyDir` 固定使用 `block-plain`，为 Docker/BuildKit overlay2 与 kind 提供 guest
+内块设备文件系统。详细限制与上线验收见 `platform/sandbox-kata/README.md`。
+
+Sandbox 的 ESO 通过独立 `auth/kubernetes-sandbox` 向 OpenBao 证明 ServiceAccount
+身份，只能读取共享的 `kv/k8s/opensandbox-api`。它不保存 reviewer JWT 或长期 Bao token；相关
+Terraform 与 Flux 边界见 `platform/sandbox-external-secrets/README.md`。
+
+OpenSandbox 阶段固定官方源码 commit 与 umbrella chart `0.2.2`，只部署 controller、
+ClusterIP server 和 CRD。API key 由 ESO 从 OpenBao 投影，明文不进入 Git。
+
+## 监控边界
+
+这里只管理 sandbox LXC 内的 Kubernetes 监控，不负责 PVE 宿主监控。LXC 与宿主共享
+内核，即使 lxcfs 虚拟化了内存和 uptime，容器内 `/proc/stat` 仍是宿主 CPU 视图；
+在 LXC 内运行 node_exporter 会生成混合语义并重复采集宿主指标，因此禁止部署。
+
+Sandbox 节点与 workload 指标来自 kubelet/cAdvisor 和 kube-state-metrics；K3s 或 LXC
+特有但上述接口未覆盖的指标，应使用目标明确的 collector，不以 node_exporter 补齐。

clusters/sandbox/apps/ci-runners.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: ci-runners
+  namespace: flux-system
+spec:
+  dependsOn:
+    - name: opensandbox
+    - name: spire-agents
+  interval: 10m
+  path: ./platform/sandbox-ci-runners
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  timeout: 20m
+  wait: true

clusters/sandbox/apps/external-secrets-operator.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: external-secrets-operator
+  namespace: flux-system
+spec:
+  dependsOn:
+    - name: monitoring-operator
+  interval: 10m
+  path: ./platform/sandbox-external-secrets/operator
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  timeout: 10m
+  wait: true

clusters/sandbox/apps/external-secrets.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: external-secrets
+  namespace: flux-system
+spec:
+  dependsOn:
+    - name: external-secrets-operator
+  interval: 10m
+  path: ./platform/sandbox-external-secrets/config
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  timeout: 10m
+  wait: true

clusters/sandbox/apps/kata.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: kata
+  namespace: flux-system
+spec:
+  dependsOn:
+    - name: monitoring-operator
+    - name: spire-agents
+  interval: 10m
+  path: ./platform/sandbox-kata
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  timeout: 35m
+  wait: true

clusters/sandbox/apps/monitoring-operator.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: monitoring-operator
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./platform/sandbox-monitoring/operator
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  timeout: 10m
+  wait: true

clusters/sandbox/apps/monitoring.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: monitoring
+  namespace: flux-system
+spec:
+  dependsOn:
+    - name: monitoring-operator
+  interval: 10m
+  path: ./platform/sandbox-monitoring/workloads
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  timeout: 10m
+  wait: true

clusters/sandbox/apps/opensandbox.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: opensandbox
+  namespace: flux-system
+spec:
+  dependsOn:
+    - name: external-secrets
+    - name: kata
+    - name: monitoring-operator
+  interval: 10m
+  path: ./platform/sandbox-opensandbox
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  timeout: 15m
+  wait: true

clusters/sandbox/apps/spire-agents.yaml

@@ -0,0 +1,18 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: spire-agents
+  namespace: flux-system
+spec:
+  dependsOn:
+    - name: spire-bootstrap
+    - name: monitoring-operator
+  interval: 10m
+  path: ./platform/sandbox-spire/agents
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  timeout: 15m
+  wait: true

clusters/sandbox/apps/spire-bootstrap.yaml

@@ -1,14 +1,15 @@
+---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: gitea-actions
+  name: spire-bootstrap
   namespace: flux-system
 spec:
   interval: 10m
-  path: ./platform/gitea-runner
-  prune: false
+  path: ./platform/sandbox-spire/bootstrap
+  prune: true
   sourceRef:
     kind: GitRepository
     name: flux-system
-  timeout: 3m
-  wait: false
+  timeout: 10m
+  wait: true

clusters/sandbox/kustomization.yaml

@@ -0,0 +1,13 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - apps/monitoring-operator.yaml
+  - apps/monitoring.yaml
+  - apps/spire-bootstrap.yaml
+  - apps/spire-agents.yaml
+  - apps/kata.yaml
+  - apps/external-secrets-operator.yaml
+  - apps/external-secrets.yaml
+  - apps/opensandbox.yaml
+  - apps/ci-runners.yaml

infrastructure/dns/records.yml

@@ -10,12 +10,20 @@ homelab_dns:
       - { zone: ad.ddupan.top, name: pve1, type: A, values: [192.168.10.4] }
       - { zone: ad.ddupan.top, name: pve2, type: A, values: [192.168.10.7] }
       - { zone: ad.ddupan.top, name: pve3, type: A, values: [192.168.10.9] }
+      - { zone: ad.ddupan.top, name: sandbox1, type: A, values: [10.60.0.11] }
+      - { zone: ad.ddupan.top, name: sandbox2, type: A, values: [10.60.0.12] }
+      - { zone: ad.ddupan.top, name: sandbox-k8s, type: A, values: [10.60.0.13] }
       - { zone: ad.ddupan.top, name: retrolab, type: A, values: [10.60.0.10] }
       - { zone: ad.ddupan.top, name: grafana, type: A, values: [192.168.10.127] }
+      - { zone: ad.ddupan.top, name: metrics-write, type: A, values: [192.168.10.127] }
       - { zone: ad.ddupan.top, name: netbox, type: A, values: [192.168.10.127] }
       - { zone: ad.ddupan.top, name: nats, type: A, values: [192.168.10.127] }
+      - { zone: ad.ddupan.top, name: nexus, type: A, values: [192.168.10.127] }
       - { zone: ad.ddupan.top, name: s3, type: A, values: [192.168.10.127] }
+      - { zone: ad.ddupan.top, name: hydra, type: A, values: [192.168.10.127] }
+      - { zone: ad.ddupan.top, name: hydra-login, type: A, values: [192.168.10.127] }
       - { zone: ad.ddupan.top, name: spire-oidc, type: A, values: [192.168.10.127] }
+      - { zone: ad.ddupan.top, name: spire-server, type: A, values: [192.168.10.127] }
       - { zone: ad.ddupan.top, name: zot, type: A, values: [192.168.10.127] }
       - { zone: ad.ddupan.top, name: zot-push, type: A, values: [192.168.10.127] }
 
@@ -53,3 +61,18 @@ homelab_dns:
         values: [ff392451-b0b1-45bb-964e-6d9372c3a9e3.cfargotunnel.com]
         proxied: true
         terraform: { managed: false }
+      # OCI 主机直接解析公网 IP，SSH 不经过 Cloudflare 代理。
+      - name: oci-arm.ddupan.top
+        type: A
+        values:
+          - 129.225.138.179
+        proxied: false
+        ttl: 300
+        terraform: { managed: false }
+      - name: oci-amd.ddupan.top
+        type: A
+        values:
+          - 129.225.176.134
+        proxied: false
+        ttl: 300
+        terraform: { managed: false }

infrastructure/docker/README.md

@@ -0,0 +1,27 @@
+# Docker 地址池与 DN42
+
+DN42 使用 `172.20.0.0/14`。laptop 的 Docker 默认地址池改为 `172.28.0.0/16`，
+按 `/24` 分配新 bridge，避免本地直连路由与 DN42 前缀重叠。
+`ansible/site.yml` 合并现有 daemon.json，保留 NVIDIA runtime；先热加载 live-restore，
+再重启 daemon 使默认地址池生效，避免已有容器随 daemon 停止。
+
+```bash
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-docker ansible-playbook -i localhost, infrastructure/docker/ansible/site.yml --check --diff
+ANSIBLE_LOCAL_TEMP=/tmp/ansible-docker ansible-playbook -i localhost, infrastructure/docker/ansible/site.yml
+```
+
+已有网络不会自动换地址。本次单独迁移结果：
+
+| 网络 | 原地址 | 当前地址/状态 |
+|---|---|---|
+| blocky_default | 172.20.0.0/16 | 172.28.0.0/24，Compose 明确声明 |
+| ps3netsrv_default | 172.21.0.0/16 | 172.28.1.0/24，Compose 明确声明 |
+| research-auto_default | 172.22.0.0/16 | 172.28.2.0/24，仓库外 research-auto Compose 明确声明 |
+| netboot_default | 172.23.0.0/16 | 删除无端点的遗留网络；netboot 两个容器均使用 host 网络 |
+
+Blocky 健康检查与 DNS 查询通过；ps3netsrv 运行，游戏数据挂载保留。
+research-auto 的 postgres 容器仅 create、未启动，原命名卷 `research-auto_postgres_data` 保留。
+
+旧运行容器曾引用仓库重组前的 `/home/panxiao81/services/<app>` 挂载路径；
+本次 Blocky 已用 `apps/blocky` 路径重建，netboot 等未重建的容器仍需在重建时使用当前 Compose。
+不要在未检查 bind mount 路径的情况下关闭 live-restore 并重启所有容器。

infrastructure/docker/ansible/ansible.cfg

@@ -0,0 +1,2 @@
+[defaults]
+local_tmp = /tmp/ansible-docker

infrastructure/docker/ansible/site.yml

@@ -0,0 +1,61 @@
+---
+- name: 为 DN42 排除 Docker 地址池重叠
+  hosts: localhost
+  connection: local
+  become: true
+  gather_facts: false
+  vars:
+    ansible_python_interpreter: /usr/bin/python3
+    docker_address_pools:
+      - base: 172.28.0.0/16
+        size: 24
+  tasks:
+    - name: 读取现有 Docker 配置并保留 runtimes 等设置
+      ansible.builtin.slurp:
+        src: /etc/docker/daemon.json
+      register: docker_config
+      no_log: true
+
+    # 先让旧 daemon 知道 live-restore，随后重启才能保留运行容器。
+    - name: 启用 live-restore
+      ansible.builtin.copy:
+        content: "{{ (docker_config.content | b64decode | from_json | combine({'live-restore': true})) | to_nice_json }}\n"
+        dest: /etc/docker/daemon.json
+        owner: root
+        group: root
+        mode: '0644'
+        backup: true
+        validate: /usr/bin/dockerd --validate --config-file %s
+      register: live_restore_config
+
+    - name: 热重载 live-restore
+      ansible.builtin.systemd_service:
+        name: docker
+        state: reloaded
+      when: live_restore_config.changed and not ansible_check_mode
+
+    - name: 确认运行中的 daemon 已启用 live-restore
+      ansible.builtin.command: docker info --format '{{ '{{' }}.LiveRestoreEnabled{{ '}}' }}'
+      register: live_restore_status
+      changed_when: false
+      retries: 5
+      delay: 2
+      until: live_restore_status.stdout == 'true'
+      when: not ansible_check_mode
+
+    - name: 配置 DN42 范围之外的默认地址池
+      ansible.builtin.copy:
+        content: "{{ (docker_config.content | b64decode | from_json | combine({'live-restore': true, 'default-address-pools': docker_address_pools})) | to_nice_json }}\n"
+        dest: /etc/docker/daemon.json
+        owner: root
+        group: root
+        mode: '0644'
+        backup: true
+        validate: /usr/bin/dockerd --validate --config-file %s
+      register: docker_pool_config
+
+    - name: 保留运行容器并重启 daemon 使地址池生效
+      ansible.builtin.systemd_service:
+        name: docker
+        state: restarted
+      when: docker_pool_config.changed and not ansible_check_mode

infrastructure/oci/README.md

@@ -1,13 +1,113 @@
-# OCI infrastructure recovery
+# OCI 云上基础设施
 
-The original Terraform source is currently unavailable. The likely authoritative
-state remains in OCI Object Storage. Reconstruct configuration here only after
-taking an encrypted independent state backup.
+`terraform/` 是独立 Terraform 根模块，从 OCI Object Storage 中的现有 state 恢复。
+Terraform 管理云 API 资源；实例内的软件、Kubernetes 和操作系统配置不在该 state 中。
 
-Safety requirements:
+## 资源与来源
 
-- preserve the existing state lineage and serial;
-- reproduce the current VM and public-network design first;
-- reach a zero-change plan before any apply;
-- protect the instance and boot volume from destruction;
-- treat migration to a private subnet as a separate reviewed change.
+- Region：`ap-osaka-1`，compartment 为 tenancy 根。
+- State：namespace `axckv9ylwqxr`，bucket `oci-k8s-free-tier-tfstate`，key `terraform.tfstate`。
+- 恢复源：2026-08-15 12:26:24 UTC 对象，25,261 字节，serial `249`，
+  lineage `c945c6c4-ee01-d7b7-23f5-37207ea60609`，Terraform `1.15.8`。
+- 7 个受管资源保留原地址：`oci_core_instance.vm`、`oci_core_vcn.vcn`、
+  `oci_core_subnet.public`、`oci_core_internet_gateway.igw`、`oci_core_route_table.public`、
+  `oci_core_security_list.public`、`oci_limits_quota.free_tier_quota`。
+- 2 个数据源：`oci_core_images.ubuntu`、`oci_identity_availability_domains.ads`；保留 4 个原输出。
+- VM：`homelab-vm`，A1 Flex，2 OCPU / 12 GB RAM / 100 GB 启动盘，
+  私网 `10.0.0.124`，恢复时公网 `129.225.138.179`。
+- VCN `10.0.0.0/16`，公共子网 `10.0.0.0/24`，默认路由经 Internet Gateway；
+  入站保留 TCP 22、UDP 41641、ICMP type 3/code 4，出站全部允许。
+- 配额语句保留 A1 4 核 / 24 GB、10 个卷、200 GB 总存储限制；这些语句不是费用保证。
+- Bucket 自身不在 state 内，不由此根模块管理。
+
+## 恢复设计
+
+原变量、模块意图、provider 精确版本和生命周期规则无法从 state 完整恢复。
+本次选择并锁定 `oracle/oci 9.1.0`，提交 lockfile；这不是声称找回了原 provider 版本。
+资源间的 VCN、路由表、安全列表、子网和 DHCP 引用已重建。
+启动镜像固定为现有 image OCID，避免数据源选中更新镜像导致 VM 替换。
+新增 `prevent_destroy` 保护现有 VM；没有用 `ignore_changes` 掩盖配置差异。
+
+Provider 使用本机 `~/.oci/config` 的 `DEFAULT` profile，可用变量覆盖 profile 和 region。
+metadata 经敏感变量传入，只保存在忽略的 `terraform.tfvars.json`，不进入版本库。
+State、plan、metadata 变量与 `.terraform/` 都不得提交；plan JSON 同样可能含敏感数据。
+保留原目录的恢复要求：保留 lineage/serial，先复现当前 VM 和公共网络设计，
+实际基础设施变更前达到严格零变更，并保护实例及启动盘；迁移私有子网须单独评审。
+已用既有 GPG 加密子密钥 `5A6A04D1B216C64E` 创建独立加密源备份
+`.recovery/source.tfstate.gpg`；本地原始副本的 lineage/serial 保持不变。
+
+## 日常维护
+
+旧 Terraform/CI 已由维护者确认停用，当前仓库已接管原 OCI Object Storage state。
+`versions.tf` 使用 OCI backend，直接连接原对象，未迁移本地恢复副本。
+认证沿用本机 OCI CLI 的 `DEFAULT` profile；不要在配置中写密钥。
+
+```bash
+cd infrastructure/oci/terraform
+terraform init
+terraform validate
+terraform plan -input=false -out=change.tfplan
+# 核对计划后执行：
+terraform apply change.tfplan
+```
+
+新 checkout 需从受限 state 副本提取 metadata 至被忽略的 `terraform.tfvars.json`。
+`prepare-local-state.py` 可执行这一步，同时保留 `.recovery/terraform.tfstate` 备份；
+当前 backend 使用远端对象，`.recovery/` 中的副本不再参与日常 plan/apply。
+下载前设置 `umask 077`，并使用 GPG 加密源备份；不要把本地副本上传覆盖远端。
+
+## 恢复验证记录
+
+Terraform 1.15.8、OCI provider 9.1.0 验证通过。
+恢复计划唯一更新是 VM metadata 的敏感标记，plan JSON 中 before/after 值相同。
+经授权 apply 后，本地完整刷新 plan 达到 `No changes`。
+旧 state 在 provider 刷新后补充 VM shape/VNIC、subnet IPv4 CIDR、route type 字段，
+这些读回差异没有产生基础设施修改计划。
+接管时重新连接原远端对象，因此新增实例计划也包含原 VM 的同一敏感标记归一化。
+
+## AMD 实例
+
+`oci_core_instance.amd` 配置为 `homelab-amd`，`VM.Standard.E2.1.Micro`，1 GB RAM，
+Ubuntu 24.04 x86_64，50 GB / 10 VPU 启动盘。复用现有公共子网和 SSH 公钥，
+没有复制 A1 实例的其他初始化内容，也不部署 Kubernetes。
+镜像固定为 `Canonical-Ubuntu-24.04-2026.08.25-0`，实例具有 `prevent_destroy` 保护。
+
+创建前 API 确认大阪为 home region、机型计费类型为 `ALWAYS_FREE`，AMD 配额剩余 2 台。
+存储盘点只有 A1 的 100 GB 启动盘；已核对两个启动盘合计 150 GB，200 GB 免费额度内剩余 50 GB。
+免费额度跨启动盘和块存储共享；后续新增资源仍需重新核对实际占用。
+
+实例已创建并确认 `RUNNING`，私网 `10.0.0.158`，公网 `129.225.176.134`。
+登录命令：`ssh [email protected]`（本次未验证 SSH 登录）。
+远端 state 已保存；创建后完整刷新 plan 为 `No changes`，退出码 0。
+
+参考：[Always Free 资源](https://docs.oracle.com/en-us/iaas/Content/FreeTier/freetier_topic-Always_Free_Resources.htm)、
+[OCI provider 认证](https://docs.oracle.com/en-us/iaas/Content/dev/terraform/configuring.htm)、
+[OCI backend 配置](https://developer.hashicorp.com/terraform/language/backend/oci)。
+
+## DNS 登录入口
+
+- ARM：`ssh [email protected]`
+- AMD：`ssh [email protected]`
+
+公网 A 记录声明位于 `../dns/records.yml`，在 Cloudflare 上关闭代理，TTL 300 秒。
+当前通过 DNS API 管理，未加入 OCI Terraform state；公网 IP 变化时需同步记录。
+
+## WireGuard/BGP 与 DN42
+
+家中端点已从 laptop 迁移到 VyOS `192.168.10.2`，AMD 与 VyOS 同属 AS4242421811，
+通过独立 WireGuard 接口建立双栈 iBGP；laptop 保留原有 NEC BGP 和 OSPF，按路由经 VyOS 转发。
+Ansible 配置与运行方法见 [ansible/README.md](ansible/README.md)。
+
+注册前缀 `172.21.111.160/27`、`fdd0:98df:15b0::/48` 已在内部路由中准备：
+VyOS `.161` / `::1`，AMD `.162` / `::2`，使用 loopback /32、/128。
+首个外部 DN42 peer 已接入 RoutedBits Osaka（AS4242420207），AMD 使用独立 `wg-dn42-1`
+和单 IPv6 MP-BGP 会话承载双栈；详见 [Ansible runbook](ansible/README.md)。
+外部明细留在 AMD，`172.20.0.0/14`、`fd00::/8` 汇总经 iBGP 下发 VyOS；IPv4 /14 再经 OSPF 下发 LAN。
+LAN 的 DN42 IPv6 /64 地址由 VyOS SLAAC 下发，fd00::/8 通过 RA RIO 分发，不通告 IPv6 默认路由。内部家中/OCI 业务路由不得向外部 DN42 邻居通告。
+
+Terraform 管理 AMD NSG、VNIC 转发与 VCN 回程；Ansible 管理路由器/主机及 ARM 的 Tailscale
+回程例外。Docker 与 DN42 的 /14 地址重叠已迁出，见 [Docker runbook](../docker/README.md)。
+
+VyOS 的 `wg42` 主 IPv4 已改为注册的 `172.21.111.161/32`，内部 BGP 改为
+单 link-local IPv6 会话承载双栈。三个 LAN 私网到 DN42 /14 由 VyOS 定向 masquerade，
+排除本 AS /27；OCI 业务保持原源地址。IPv6 不做 NAT，由 `ansible/dn42-ra.yml` 管理三个 LAN 的 SLAAC 与专用路由通告。

infrastructure/oci/ansible/README.md

@@ -0,0 +1,232 @@
+# VyOS ↔ OCI：WireGuard 与 DN42 内部 BGP
+
+站点端已从 laptop 迁移到 VyOS `192.168.10.2`。VyOS 位于双层 NAT 后，主动连接
+`oci-amd.ddupan.top:51820`，keepalive 25 秒；LAN 访问 DN42 时在 VyOS 做定向 masquerade。
+主机配置由 Ansible 管理；OCI NSG、VNIC 转发和 VCN 回程路由由旁边的 Terraform 管理。
+
+| 节点 | 接口 | 传输 IPv4 | 传输 IPv6 | ASN |
+|---|---|---|---|---|
+| VyOS | wg42 | 172.21.111.161/32 | fe80::1811:1/64（BGP） | 4242421811 |
+| AMD | wg-oci | 10.255.254.1/30（历史传输地址） | fe80::1811:2/64（BGP） | 4242421811 |
+
+AMD 显式设置 `fe80::1811:2/64`；VyOS BGP 使用固定 `fe80::1811:1/64`，双方 AllowedIPs 包含
+`fe80::/64`。FRR 在 ULA 建邻时仍需接口具有 link-local 下一跳地址。
+
+MTU 1380，Linux 使用 `Table = off`，WireGuard AllowedIPs 用于选 peer 与源地址校验，
+站点路由由 iBGP 安装。内外部均使用单条 IPv6 link-local 会话承载双 AFI，并启用 extended-nexthop。
+内部旧 IPv4/ULA BGP 邻居已退役；ULA 传输地址保留用于路由下一跳，不再用于建邻。
+VyOS 10.2.4 通过 `OCI-MP-IN` 的 `ipv6-next-hop prefer-global` 优先采用通告中的 ULA 下一跳，
+避免 link-local NHT 显示 overlay index unresolved、BGP 已建邻但路由未安装。
+
+## 地址与通告边界
+
+已注册 `172.21.111.160/27`、`fdd0:98df:15b0::/48`：
+
+| 节点 | 路由器 IPv4 | 路由器 IPv6 |
+|---|---|---|
+| VyOS（IPv4 在 wg42，IPv6 在 lo） | 172.21.111.161/32 | fdd0:98df:15b0::1/128 |
+| AMD loopback | 172.21.111.162/32 | fdd0:98df:15b0::2/128 |
+
+VyOS 为注册的 /27、/48 建立 distance 254 的 blackhole 聚合路由，保证精确前缀存在，
+避免未分配地址落入默认路由。已分配的本地地址及 AMD 的 /32、/128 优先于聚合。
+
+内部通告严格过滤：
+
+- VyOS → AMD：`192.168.10.0/24`、`10.60.0.0/24`、`10.61.0.0/24` 和注册 /27、/48。
+- AMD → VyOS：`10.0.0.0/24`、AMD 的注册 /32、/128，以及 DN42 汇总 `172.20.0.0/14`、`fd00::/8`。
+- VyOS 向 LAN OSPF 只重分发 OCI /24、DN42 /14 和注册 IPv4 /27，使用精确 route-map、E1 metric。
+  既有直连 LAN/SDN 的 OSPF area 声明保持不变，不使用泛化的 redistribute connected。
+
+**首个外部 peer 为 RoutedBits Osaka（AS4242420207），由 `dn42.yml` 单独管理。** 外部邻居使用独立的 import/export
+过滤，只对外通告注册 /27、/48；禁止把上述内部业务前缀的过滤器复用到外部邻居。
+入口使用 DN42 指南的保留地址、互联网络与前缀长度规则（IPv6 /44–/64），
+并优先拒收本 AS、LAN、OCI 前缀；尚未配置注册表 ROA 校验。外部明细留在 AMD，汇总通过 iBGP 下发 VyOS；IPv4 汇总再经 OSPF 下发 LAN。
+
+每个外部 WireGuard peer 使用独立接口，BGP 可复用本机 loopback 地址。
+单接口多个 WireGuard peer 要求可明确区分的 AllowedIPs；多家 peer 都提供同一 DN42 路由范围时，
+使用独立接口让 BGP 决定出口，避免相同 AllowedIPs 抢占 peer。
+
+## 执行
+
+```bash
+cd infrastructure/oci/ansible
+export SSH_AUTH_SOCK="$(gpgconf --list-dirs agent-ssh-socket)"
+ansible-playbook site.yml --check --diff
+ansible-playbook site.yml
+ansible-playbook site.yml  # 复跑应 changed=0
+```
+
+`vyos.yml` 先在路由器本机生成密钥并保存，再交换公钥并增量应用 VyOS set 命令。
+VyOS native config 含私钥，因此相关模块使用 `no_log`，不把配置备份到 Git 或打印出来。
+AMD 私钥在 `/etc/wireguard/wg-oci.key`（0600），由本机 PostUp 加载，不返回控制机。
+首次 check mode 无法生成私钥，因此会跳过依赖不存在公钥的 Linux 配置渲染。
+
+`retire-laptop.yml` 是迁移收尾：先检查 VyOS 邻居，再停止 laptop 的 wg-oci，
+删除试验邻居、三个新增 network 语句及专用防火墙链，保留 laptop 原 AS65001 ↔ NEC AS65000
+会话、原有 VPN 路由和 OSPF。旧私钥保留在 laptop 受限文件中，隧道和防火墙单元已禁用。
+
+Linux 端 FRR 通过 `vtysh -f` 应用独立配置片段，另行 `write memory` 持久化；
+文件变更时重建受管邻居，未变更的重跑不重置会话。移除前缀时还须显式删除已退出管理的
+`network` 语句，不能只追加 set 命令，也不能清空整份 BGP 配置。
+
+## OCI 回程与 Tailscale
+
+VCN 虚拟路由器不参与主机间 iBGP；三个家中业务前缀的静态回程指向 AMD Private IP OCID。
+首次启用时必须先将 VNIC `skip_source_dest_check` 设为 true，OCI 才接受该私有 IP 为路由目标。
+当前 Terraform 的 route table → subnet → instance 依赖使首次引导需要先设置该标志。
+重建 AMD 后须重新查询并更新 `amd_router_private_ip_ocid`。
+
+ARM 接受 Tailscale 家中子网路由，table 52 原本抢走回程。
+Ansible 在 ARM 设置 priority 5101–5103、仅匹配这三个目的前缀的 `lookup main` 规则，
+让这些流量使用 OCI 网关→AMD；其他 Tailscale 地址保持原路径。
+AMD 的 Zebra route-map 仅为本机发起的 BGP 业务流量选择 `10.0.0.158` 源地址，不改写转发源地址。
+
+## Docker 地址冲突
+
+DN42 使用 `172.20.0.0/14`。原 laptop Docker 的四个 /16 已清除，默认池改为 `172.28.0.0/16`，
+详见 [Docker runbook](../../docker/README.md)。最长前缀匹配决定路由，但不能解决两套网络实际
+地址重叠；不能只检查本 AS 注册的 /27 而忽略其他 DN42 注册前缀。
+
+## 验证与停用
+
+```bash
+# VyOS operational mode
+show interfaces wireguard wg42 summary
+show bgp summary
+show ip route 172.21.111.162/32
+show ipv6 route fdd0:98df:15b0::2/128
+# AMD
+sudo wg show wg-oci latest-handshakes
+sudo vtysh -c 'show bgp summary'
+ping 192.168.10.4
+ping -I 172.21.111.162 172.21.111.161
+ping -6 -I fdd0:98df:15b0::2 fdd0:98df:15b0::1
+```
+
+业务网段测试应使用业务源地址；DN42 loopback 测试使用注册地址。
+LAN 已通过 `dn42-ra.yml` 部署 DN42 SLAAC 与专用 RIO，不发布 IPv6 默认路由；OCI VCN 保持原配置。
+停用或回滚须同时处理 BGP、WireGuard、OSPF 重分发、VCN 回程和 ARM 例外规则，
+不能仅停止隧道后留下静态回程指向不可达节点。
+
+参考：[WireGuard](https://www.wireguard.com/quickstart/)、
+[VyOS WireGuard](https://docs.vyos.io/en/1.5/configuration/interfaces/wireguard.html)、
+[DN42 入门](https://www.dn42.dev/howto/Getting-Started)。
+
+## 迁移验收
+
+2026-09-14：
+
+- VyOS IPv4 iBGP 收到 OCI /24、AMD /32，通告三个家中前缀与注册 /27；IPv6 会话双方各收到一条前缀。
+- 两端 DN42 loopback IPv4、IPv6 互通；IPv6 本次采样约 3.1 ms。
+- laptop 的 `10.0.0.0/24` 与 `172.21.111.160/27` 经 OSPF 指向 `192.168.10.2`，不再使用旧隧道。
+- PVE1 可访问 ARM 私网和 AMD 的 DN42 IPv4；AMD 可访问 PVE1、`10.60.0.1`、`10.61.0.1`。
+- laptop 旧 WireGuard 和专用防火墙 service 已停止/禁用，原 NEC BGP 会话保留。
+
+LAN 网关可能返回 ICMP Redirect，提示客户端将 VyOS 作为同网段下一跳；这是既有 LAN
+拓扑的正常结果，没有为此修改客户端或网关的 redirect 策略。
+
+## AMD 外部 DN42 首个接口
+
+2026-09-15 已通过 `ansible-playbook dn42.yml` 准备独立监听：
+
+- 接口：`wg-dn42-1`，UDP endpoint：`oci-amd.ddupan.top:51821`（`129.225.176.134:51821`）。
+- 公钥：`YQ/X3QmNocnr0u4aUm5qhcV328StSNtg+ULd9AKCdhQ=`。
+- 私钥仅保存在 AMD `/etc/wireguard/wg-dn42-1.key`，由 root 受限目录保护，不返回控制机。
+- `wg-quick@wg-dn42-1` 开机启动；主机入站规则随接口启停，OCI NSG 规则由 Terraform 管理。
+- Link-local：`fe80::1811:2/64`，本机作用域为 `%wg-dn42-1`。首个 peer 使用单条 IPv6 BGP 会话承载双栈（MP-BGP + RFC 8950 extended next hop）。
+- 对端：AS4242420207，`router.osa1.routedbits.com:51811`，link-local `fe80::207`。
+- 对端公钥：`96PwUEGi/ijdmKO+IjuZ+J6DeykuTRukZD5atajfeH4=`。
+- WireGuard 使用 `Table = off`；AllowedIPs 为 `fe80::/64, 172.20.0.0/14, 10.0.0.0/8, 172.31.0.0/16, fd00::/8`，keepalive 25 秒。
+- 双 AFI 共用 IPv6 TCP 会话并启用 extended-nexthop；每 AFI maximum-prefix 10000，出口只允许注册 /27 和 /48。
+- 本机发起 DN42 流量使用注册地址作为 preferred source，不做 NAT。
+- Ubuntu 自带 FRR 8.4.4 不满足 [DN42 FRR 指南](https://dn42.dev/howto/frr) 的 link-local 版本要求。
+  `tasks/frr-dn42.yml` 使用官方 frr-10.7 软件源，固定 10.7.1；升级前配置仅在 AMD `/var/backups/frr-before-dn42` 备份。
+
+原 `wg-oci:51820` 继续承载与 VyOS 的内部互联。
+
+2026-09-15 接入验收：WireGuard 握手与 `fe80::207%wg-dn42-1` 连通；FRR 10.7.1
+会话 Established，双方已协商 IPv4/IPv6 AFI 与 extended nexthop。采样接收 IPv4 1174、IPv6 1273 条，
+对外仅通告 `172.21.111.160/27`、`fdd0:98df:15b0::/48`。AMD 无需显式指定源地址，
+即可访问对端 `172.20.19.78`、`fdb1:e72a:343d::f`，各 3/3 回复，约 1 ms；
+IPv4 内核路由下一跳为 `via inet6 fe80::207 dev wg-dn42-1`。内部 VyOS 双栈 BGP 会话已恢复。
+
+## 向 LAN 分发 DN42 汇总
+
+`site.yml` 在 AMD 生成 `172.20.0.0/14`、`fd00::/8` 的 BGP aggregate，并通过内部精确
+prefix-list 通告 VyOS。不使用全局 `summary-only`，避免抑制对外通告的注册 /27、/48；
+对外出口过滤仍只允许这两个注册前缀。AMD 保留外部明细与汇总丢弃路径，无匹配明细的流量
+在 AMD 丢弃。汇总只要仍有覆盖的 BGP 明细（包括本 AS 注册前缀）就可能存在，不能作为外部
+peer 在线状态指示。自己的 /27、/48 更具体，继续指向本地站点。
+
+VyOS 将 IPv4 /14 通过既有 OSPF E1 分发到 LAN；IPv6 /8 通过 RA 的 RIO 分发至接受该选项的客户端。
+LAN 的 DN42 IPv6 地址通过 SLAAC 自动分配。
+当前 LAN IPv4 客户端访问 DN42 /14 由 VyOS 定向 masquerade 到 `172.21.111.161`；
+IPv6 使用 SLAAC 分配的注册地址直接路由。
+AMD 只放行注册前缀在内部 `wg-oci` 与外部 `wg-dn42-1` 之间转发。
+
+2026-09-15 汇总验收：VyOS 双栈 BGP 分别收到 /14、/8，下一跳为 AMD；
+laptop 的 `172.20.0.0/14` 为 OSPF 路由，经 `192.168.10.2 dev br0`。
+使用 VyOS 注册的 /32、/128 作为源，经 AMD 访问 RoutedBits 的双栈地址各 3/3 回复，
+约 4–5 ms。`site.yml` 执行成功，ARM 无变更；LAN 地址配置保持原状。
+
+## DN42 DNS 转发
+
+`ansible-playbook dn42.yml dn42-dns.yml` 管理入口路由和 VyOS DNS。LAN 的 Blocky
+(`192.168.10.127`) 将 `.dn42`、172.20–23 的 IPv4 反向区和 `d.f.ip6.arpa`
+转给 VyOS `192.168.10.2:53`。VyOS 仅接受三个内部 LAN 网段，使用注册地址
+`172.21.111.161` / `fdd0:98df:15b0::1` 发起递归转发，不做 NAT。
+
+| 上游 | IPv4 | IPv6 |
+|---|---|---|
+| a0.recursive-servers.dn42 | 172.20.0.53 | fd42:d42:d42:54::1 |
+| a3.recursive-servers.dn42 | 172.23.0.53 | fd42:d42:d42:53::1 |
+
+两个上游的双栈地址均配置，递归请求设置 RD；转发域配置 NTA，避免使用公网根信任链
+验证 DN42 私有命名空间。本地转发器不声明已完成 DN42 DNSSEC 信任锚验证。
+IPv4 anycast /32 需要允许四个 `172.2x.0.0/24` 中的 /28–/32，不能只保留 /14 的 /21–/29。
+新增互联网络明细仅由 AMD 接收；LAN 汇总仍是既定 /14、通过 RIO 通告的 IPv6 /8。
+NEC 备用 DNS 与 k3s CoreDNS 本次未修改。
+
+DNS 验收（2026-09-15）：从 VyOS 用注册地址直查 a0/a3 的四个双栈地址均获得回复。
+LAN 查询 Blocky 可得到 a0 的 A、a3 的 AAAA；AD 与公网域名正常，Blocky healthy。
+VyOS DNS playbook 复跑 changed=0；AMD 已应用完整入口规则。
+
+## VyOS LAN 到 DN42 masquerade
+
+规则 18100 排除本 AS `172.21.111.160/27`；18110、18120、18130 分别匹配三个 LAN
+源网段，目的仅 `172.20.0.0/14` 且出口 `wg42`，translation 为 `masquerade`。
+为使 masquerade 选中注册地址，`172.21.111.161/32` 从 lo 移到 wg42，并移除
+`10.255.254.2/30`；不能在 wg42 仍以传输私网地址为主 IPv4 时直接启用 masquerade。
+现有 OCI 业务互联继续保留原源地址，DNS 转发使用的 `172.21.111.161` 保持可用。
+AMD 仍仅允许 DN42 注册源前缀进入外部隧道，不在 AMD 做第二次 NAT。
+
+2026-09-15 masquerade 验收：laptop `192.168.10.127` 到 RoutedBits `172.20.19.78`
+3/3 回复约 4.7 ms，VyOS NAT 表显示转换为 `172.21.111.161`；到 ARM `10.0.0.124`
+3/3 回复约 4.2 ms，NAT 表确认保留 `192.168.10.127`。
+内部 link-local 单会话双 AFI 已建立；外部 peer 保持独立接口和精确出口。
+
+## LAN DN42 IPv6 RA（不发布默认路由）
+
+执行 `ansible-playbook dn42-ra.yml`，为三个 LAN 启用 SLAAC：
+
+| LAN | VyOS 接口 | 前缀 | 路由器地址 |
+|---|---|---|---|
+| 192.168.10.0/24 | eth0 | fdd0:98df:15b0:10::/64 | fdd0:98df:15b0:10::1 |
+| 10.60.0.0/24 | eth1 | fdd0:98df:15b0:60::/64 | fdd0:98df:15b0:60::1 |
+| 10.61.0.0/24 | eth2 | fdd0:98df:15b0:61::/64 | fdd0:98df:15b0:61::1 |
+
+Router Lifetime 为 **0**，不发布 `::/0`；PIO 开启 on-link 与 autonomous 标志，
+preferred lifetime 14400 秒、valid lifetime 86400 秒。RIO 只包含 `fd00::/8`，
+有效期 180 秒；RA 周期 10–30 秒。不发布 RDNSS、DNSSL、DHCPv6 标志或链路 MTU，
+保留客户端现有 DNS 和公网出口。IPv6 经 VyOS→AMD→DN42 直接路由，不做 NAT66。
+现有 /48 对外通告及内部回程已覆盖这三个 /64，无须泄漏每个 LAN 的明细到外部。
+
+客户端须支持并接受 RIO。当前 laptop 的 br0 `accept_ra=0`、`forwarding=1`，
+不会自动配置；本次保留其网络设置。Linux 路由主机如需接受 RA，需要在自身网络管理
+配置中显式启用，并允许至少 /8 的 RIO（`accept_ra_rt_info_max_plen`）。
+关闭 RA 时注意 PIO 的有效期；不要只删路由器接口地址而留下仍有效的客户端地址。
+
+2026-09-15 RA 抓包验收：主 LAN 收到不带标签的 `:10::/64`；VLAN 100/110
+分别携带 `:60::/64`、`:61::/64`。三者 Router Lifetime 均为 0，PIO 为 onlink/auto，
+RIO 为 fd00::/8、180 秒，没有 DNS 或默认路由通告。`dn42-ra.yml` 复跑 changed=0。
+同一 LAN 上的临时 Linux 测试客户端自动获得地址与 RIO，无 IPv6 默认路由；测试后自动删除。

infrastructure/oci/ansible/ansible.cfg

@@ -0,0 +1,8 @@
+[defaults]
+inventory = inventory/hosts.yml
+roles_path = roles
+local_tmp = /tmp/ansible-oci
+host_key_checking = True
+interpreter_python = auto_silent
+[ssh_connection]
+ssh_args = -o ControlMaster=auto -o ControlPersist=60s -o StrictHostKeyChecking=accept-new

infrastructure/oci/ansible/dn42-dns.yml

@@ -0,0 +1,23 @@
+---
+- name: 配置 VyOS DN42 DNS 转发
+  hosts: site_routers
+  gather_facts: false
+  vars:
+    dn42_dns_zones:
+      - dn42
+      - 20.172.in-addr.arpa
+      - 21.172.in-addr.arpa
+      - 22.172.in-addr.arpa
+      - 23.172.in-addr.arpa
+      - d.f.ip6.arpa
+    dn42_dns_servers:
+      - 172.20.0.53
+      - 172.23.0.53
+      - fd42:d42:d42:54::1
+      - fd42:d42:d42:53::1
+  tasks:
+    - name: 配置受限监听、注册地址源与条件转发
+      vyos.vyos.vyos_config:
+        lines: "{{ lookup('template', 'templates/vyos-dn42-dns.conf.j2').splitlines() | reject('equalto', '') | list }}"
+        save: true
+        comment: Ansible DN42 DNS forwarding

infrastructure/oci/ansible/dn42-ra.yml

@@ -0,0 +1,21 @@
+---
+- name: 在 LAN 通告 DN42 SLAAC 地址与专用路由
+  hosts: site_routers
+  gather_facts: false
+  vars:
+    dn42_ra_lans:
+      - interface: eth0
+        prefix: fdd0:98df:15b0:10::/64
+        address: fdd0:98df:15b0:10::1/64
+      - interface: eth1
+        prefix: fdd0:98df:15b0:60::/64
+        address: fdd0:98df:15b0:60::1/64
+      - interface: eth2
+        prefix: fdd0:98df:15b0:61::/64
+        address: fdd0:98df:15b0:61::1/64
+  tasks:
+    - name: 配置接口地址、SLAAC 与 RIO，不通告默认路由或 DNS
+      vyos.vyos.vyos_config:
+        lines: "{{ lookup('template', 'templates/vyos-dn42-ra.conf.j2').splitlines() | reject('equalto', '') | list }}"
+        save: true
+        comment: Ansible DN42 SLAAC without default route

infrastructure/oci/ansible/dn42.yml

@@ -0,0 +1,98 @@
+---
+# 首个外部 peer：RoutedBits Osaka，IPv6 link-local MP-BGP。
+- name: 准备 AMD DN42 WireGuard 监听
+  hosts: oci_amd
+  become: true
+  vars:
+    dn42_interface: wg-dn42-1
+    dn42_port: 51821
+    dn42_linklocal: fe80::1811:2/64
+    dn42_peer_linklocal: fe80::207
+    dn42_peer_asn: 4242420207
+    dn42_peer_endpoint: router.osa1.routedbits.com:51811
+    dn42_peer_public_key: 96PwUEGi/ijdmKO+IjuZ+J6DeykuTRukZD5atajfeH4=
+  tasks:
+    - name: 准备 FRR link-local 支持
+      ansible.builtin.import_tasks: tasks/frr-dn42.yml
+    - name: 创建受限密钥目录
+      ansible.builtin.file:
+        path: /etc/wireguard
+        state: directory
+        owner: root
+        group: root
+        mode: '0700'
+    - name: 在 AMD 本机生成独立私钥
+      ansible.builtin.shell: umask 077; wg genkey > /etc/wireguard/{{ dn42_interface }}.key
+      args:
+        creates: /etc/wireguard/{{ dn42_interface }}.key
+      no_log: true
+    - name: 写入监听配置
+      ansible.builtin.copy:
+        dest: /etc/wireguard/{{ dn42_interface }}.conf
+        owner: root
+        group: root
+        mode: '0600'
+        content: |
+          # Ansible 管理；首个 peer 使用 IPv6 link-local MP-BGP + extended next hop。
+          [Interface]
+          Address = {{ dn42_linklocal }}
+          ListenPort = {{ dn42_port }}
+          MTU = 1380
+          Table = off
+          PostUp = wg set %i private-key /etc/wireguard/{{ dn42_interface }}.key
+          PostUp = iptables -w -C INPUT -p udp --dport {{ dn42_port }} -j ACCEPT 2>/dev/null || iptables -w -I INPUT 1 -p udp --dport {{ dn42_port }} -j ACCEPT
+          PostDown = iptables -w -D INPUT -p udp --dport {{ dn42_port }} -j ACCEPT
+
+          [Peer]
+          PublicKey = {{ dn42_peer_public_key }}
+          Endpoint = {{ dn42_peer_endpoint }}
+          AllowedIPs = fe80::/64, 172.20.0.0/14, 10.0.0.0/8, 172.31.0.0/16, fd00::/8
+          PersistentKeepalive = 25
+      notify: 重启 DN42 接口
+    - name: 启用 DN42 监听
+      ansible.builtin.systemd_service:
+        name: wg-quick@{{ dn42_interface }}
+        enabled: true
+        state: started
+    - name: 应用配置
+      ansible.builtin.meta: flush_handlers
+    - name: 写入外部 BGP 配置片段
+      ansible.builtin.template:
+        src: templates/dn42-bgp.conf.j2
+        dest: /etc/frr/dn42-routedbits.vtysh
+        owner: root
+        group: frr
+        mode: '0640'
+      register: dn42_bgp_config
+      changed_when: dn42_bgp_config.changed or ('(deleted)' in frr_running.stdout)
+      notify: 应用 DN42 BGP
+    - name: 应用 BGP 配置
+      ansible.builtin.meta: flush_handlers
+    - name: 读取公开信息
+      ansible.builtin.command: wg show {{ dn42_interface }} {{ item }}
+      loop:
+        - public-key
+        - listen-port
+      changed_when: false
+      register: dn42_public_info
+    - name: 显示公钥和端口
+      ansible.builtin.debug:
+        msg: '{{ dn42_public_info.results | map(attribute="stdout") | list }}'
+  handlers:
+    - name: 重启 FRR
+      ansible.builtin.systemd_service:
+        name: frr
+        state: restarted
+      when: not ansible_check_mode
+    - name: 重启 DN42 接口
+      ansible.builtin.systemd_service:
+        name: wg-quick@{{ dn42_interface }}
+        state: restarted
+      when: not ansible_check_mode
+    - name: 应用 DN42 BGP
+      ansible.builtin.command: vtysh -f /etc/frr/dn42-routedbits.vtysh
+      notify: 保存 FRR 配置
+      when: not ansible_check_mode
+    - name: 保存 FRR 配置
+      ansible.builtin.command: vtysh -c 'write memory'
+      when: not ansible_check_mode

infrastructure/oci/ansible/group_vars/all.yml

@@ -0,0 +1,9 @@
+---
+wg_interface: wg-oci
+wg_port: 51820
+wg_mtu: 1380
+wg_home_prefixes: [192.168.10.0/24, 10.60.0.0/24, 10.61.0.0/24]
+wg_cloud_prefixes: [10.0.0.0/24]
+dn42_asn: 4242421811
+dn42_ipv4: 172.21.111.160/27
+dn42_ipv6: fdd0:98df:15b0::/48

infrastructure/oci/ansible/host_vars/laptop.yml

@@ -0,0 +1,12 @@
+---
+wg_address: 10.255.254.2/30
+wg_peer_address: 10.255.254.1
+wg_peer_host: oci_amd
+wg_endpoint: oci-amd.ddupan.top:51820
+wg_keepalive: 25
+wg_lan_interface: br0
+bgp_asn: 65001
+bgp_peer_asn: 4242421811
+bgp_router_id: 192.168.10.127
+bgp_export: '{{ wg_home_prefixes }}'
+bgp_import: '{{ wg_cloud_prefixes }}'

infrastructure/oci/ansible/host_vars/oci_amd.yml

@@ -0,0 +1,34 @@
+---
+wg_address: 10.255.254.1/30
+wg_peer_address: 172.21.111.161
+wg_peer_host: vyos_rtr
+wg_endpoint: ''
+wg_keepalive: 0
+wg_lan_interface: ens3
+bgp_asn: 4242421811
+bgp_peer_asn: 4242421811
+bgp_router_id: 10.0.0.158
+bgp_export:
+- 10.0.0.0/24
+- 172.21.111.162/32
+bgp_import:
+- 192.168.10.0/24
+- 10.60.0.0/24
+- 10.61.0.0/24
+- 172.21.111.160/27
+wg_ipv6_address: fdd0:98df:15b0:ffff::1/64
+wg_peer_ipv6: fdd0:98df:15b0:ffff::2
+bgp_export6:
+- fdd0:98df:15b0::2/128
+bgp_import6:
+- fdd0:98df:15b0::/48
+wg_linklocal_address: fe80::1811:2/64
+
+# 仅向内部邻居通告汇总；外部 peer 保持精确出口过滤。
+bgp_summary: [172.20.0.0/14]
+bgp_summary6: [fd00::/8]
+dn42_external_interface: wg-dn42-1
+
+# 内部与外部统一使用 link-local 单会话双 AFI；节点地址仍在 loopback。
+bgp_transport_peer: fe80::1811:1
+bgp_retired_peers: [10.255.254.2, "fdd0:98df:15b0:ffff::2"]

infrastructure/oci/ansible/inventory/hosts.yml

@@ -0,0 +1,26 @@
+---
+all:
+  children:
+    wireguard_sites:
+      hosts:
+        oci_amd:
+          ansible_host: oci-amd.ddupan.top
+          ansible_user: ubuntu
+    oci_routed_hosts:
+      hosts:
+        oci_arm:
+          ansible_host: oci-arm.ddupan.top
+          ansible_user: ubuntu
+    retired_wireguard_sites:
+      hosts:
+        laptop:
+          ansible_connection: local
+          ansible_python_interpreter: /usr/bin/python3
+    site_routers:
+      hosts:
+        vyos_rtr:
+          ansible_host: 192.168.10.2
+          ansible_user: vyos
+          ansible_connection: ansible.netcommon.network_cli
+          ansible_network_os: vyos.vyos.vyos
+          ansible_ssh_private_key_file: ~/.ssh/id_ed25519

infrastructure/oci/ansible/retire-laptop.yml

@@ -0,0 +1,92 @@
+---
+- name: 确认路由器内部 BGP 已建立
+  hosts: site_routers
+  gather_facts: false
+  tasks:
+    - name: 确认到 AMD 的邻居
+      vyos.vyos.vyos_command:
+        commands: show bgp neighbors 10.255.254.1
+      register: migration_bgp
+      changed_when: false
+      failed_when: "'BGP state = Established' not in migration_bgp.stdout[0]"
+
+- name: 退役 laptop 的 WireGuard 试验端点
+  hosts: retired_wireguard_sites
+  become: true
+  tasks:
+    - name: 停止并禁用旧隧道
+      ansible.builtin.systemd_service:
+        name: wg-quick@wg-oci
+        state: stopped
+        enabled: false
+
+    - name: 检查原 BGP 试验邻居是否存在
+      ansible.builtin.command: vtysh -c 'show running-config'
+      register: laptop_frr
+      changed_when: false
+
+    - name: 只移除本次试验添加的 BGP 节点，保留 NEC 邻居和 OSPF
+      ansible.builtin.command:
+        argv:
+          - vtysh
+          - -c
+          - configure terminal
+          - -c
+          - router bgp 65001
+          - -c
+          - no neighbor 10.255.254.1
+          - -c
+          - address-family ipv4 unicast
+          - -c
+          - no network 192.168.10.0/24
+          - -c
+          - no network 10.60.0.0/24
+          - -c
+          - no network 10.61.0.0/24
+          - -c
+          - exit-address-family
+          - -c
+          - exit
+          - -c
+          - no ip protocol bgp route-map OCI-WG-SOURCE
+          - -c
+          - no route-map OCI-WG-SOURCE
+          - -c
+          - no ip prefix-list OCI-WG-IN
+          - -c
+          - no ip prefix-list OCI-WG-OUT
+          - -c
+          - end
+          - -c
+          - write memory
+      when: "'neighbor 10.255.254.1 remote-as' in laptop_frr.stdout"
+
+    - name: 停止并禁用旧防火墙启动单元
+      ansible.builtin.systemd_service:
+        name: oci-wg-firewall
+        state: stopped
+        enabled: false
+
+    - name: 只删除旧隧道专用防火墙链
+      ansible.builtin.shell: |
+        set -eu
+        changed=0
+        for pair in INPUT:OCI-WG-IN FORWARD:OCI-WG-FWD; do
+          parent=${pair%%:*}; chain=${pair#*:}
+          if iptables -w -nL "$chain" >/dev/null 2>&1; then
+            while iptables -w -C "$parent" -j "$chain" 2>/dev/null; do
+              iptables -w -D "$parent" -j "$chain"
+            done
+            iptables -w -F "$chain"
+            iptables -w -X "$chain"
+            changed=1
+          fi
+        done
+        echo "$changed"
+      register: retired_chains
+      changed_when: retired_chains.stdout == '1'
+
+    - name: 移除旧的 BGP 配置片段，避免误用
+      ansible.builtin.file:
+        path: /etc/frr/oci-wireguard.vtysh
+        state: absent

infrastructure/oci/ansible/roles/wireguard_bgp/handlers/main.yml

@@ -0,0 +1,20 @@
+---
+- name: 重载 FRR daemons
+  ansible.builtin.systemd_service:
+    name: frr
+    state: reloaded
+  when: not ansible_check_mode
+- name: 刷新专用防火墙
+  ansible.builtin.systemd_service:
+    name: oci-wg-firewall
+    daemon_reload: true
+    state: restarted
+  when: not ansible_check_mode
+- name: 重启 WireGuard
+  ansible.builtin.systemd_service:
+    name: wg-quick@{{ wg_interface }}
+    state: restarted
+  when: not ansible_check_mode
+- name: 应用 BGP 增量配置
+  ansible.builtin.include_tasks: apply-bgp.yml
+  when: not ansible_check_mode

infrastructure/oci/ansible/roles/wireguard_bgp/tasks/apply-bgp.yml

@@ -0,0 +1,8 @@
+---
+- name: 应用受管 FRR 配置片段
+  ansible.builtin.command: vtysh -f /etc/frr/oci-wireguard.vtysh
+  register: bgp_apply
+  failed_when: bgp_apply.rc != 0 or '% Unknown' in bgp_apply.stdout or '% Unknown' in bgp_apply.stderr
+
+- name: 保存完整运行配置以便重启恢复
+  ansible.builtin.command: vtysh -c 'write memory'

infrastructure/oci/ansible/roles/wireguard_bgp/tasks/dn42-loopback.yml

@@ -0,0 +1,32 @@
+---
+- name: 安装 AMD DN42 loopback 地址启动单元
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/dn42-loopback.service
+    mode: '0644'
+    content: |
+      [Unit]
+      Description=DN42 router loopback addresses
+      Before=frr.service
+      [Service]
+      Type=oneshot
+      ExecStart=/usr/sbin/ip address replace 172.21.111.162/32 dev lo
+      ExecStart=/usr/sbin/ip -6 address replace fdd0:98df:15b0::2/128 dev lo
+      RemainAfterExit=yes
+      [Install]
+      WantedBy=multi-user.target
+  register: dn42_loopback_unit
+
+- name: 启用 AMD DN42 loopback
+  ansible.builtin.systemd_service:
+    name: dn42-loopback
+    daemon_reload: true
+    enabled: true
+    state: "{{ 'restarted' if dn42_loopback_unit.changed else 'started' }}"
+  when: not ansible_check_mode
+
+- name: 开启路由器 IPv6 转发
+  ansible.posix.sysctl:
+    name: net.ipv6.conf.all.forwarding
+    value: '1'
+    sysctl_file: /etc/sysctl.d/90-dn42-forwarding.conf
+    sysctl_set: true

infrastructure/oci/ansible/roles/wireguard_bgp/tasks/main.yml

@@ -0,0 +1,163 @@
+---
+- name: 安装 WireGuard 与 FRR
+  ansible.builtin.apt:
+    name: [wireguard-tools, frr, iptables]
+    state: present
+    update_cache: true
+    cache_valid_time: 3600
+  register: packages
+  retries: 3
+  delay: 5
+  until: packages is succeeded
+
+- name: 创建 WireGuard 受限目录
+  ansible.builtin.file:
+    path: /etc/wireguard
+    state: directory
+    owner: root
+    group: root
+    mode: '0700'
+
+- name: 在站点本机生成私钥，永不复制到控制机
+  ansible.builtin.shell: 'umask 077; wg genkey > /etc/wireguard/{{ wg_interface }}.key'
+  args:
+    creates: '/etc/wireguard/{{ wg_interface }}.key'
+  no_log: true
+
+- name: 检查现有私钥
+  ansible.builtin.stat:
+    path: '/etc/wireguard/{{ wg_interface }}.key'
+  register: wg_key_file
+
+- name: 读取可交换的公钥
+  ansible.builtin.shell: 'wg pubkey < /etc/wireguard/{{ wg_interface }}.key'
+  register: wg_public_key
+  changed_when: false
+  check_mode: false
+  when: wg_key_file.stat.exists
+
+- name: 启用 BGP daemon，保留其他协议
+  ansible.builtin.lineinfile:
+    path: /etc/frr/daemons
+    regexp: '^bgpd='
+    line: bgpd=yes
+  notify: 重载 FRR daemons
+  when: not ansible_check_mode or not packages.changed
+
+- name: 确保 FRR 运行
+  ansible.builtin.systemd_service:
+    name: frr
+    enabled: true
+    state: started
+  when: not ansible_check_mode
+
+- name: 配置 DN42 路由器地址
+  ansible.builtin.include_tasks: dn42-loopback.yml
+  when: bgp_export6 is defined
+
+- name: 开启 IPv4 转发
+  ansible.posix.sysctl:
+    name: net.ipv4.ip_forward
+    value: '1'
+    sysctl_file: /etc/sysctl.d/90-oci-wireguard.conf
+    sysctl_set: true
+
+- name: 安装专用防火墙规则脚本
+  ansible.builtin.template:
+    src: firewall.sh.j2
+    dest: /usr/local/sbin/oci-wg-firewall
+    owner: root
+    group: root
+    mode: '0755'
+  notify: 刷新专用防火墙
+
+- name: 安装防火墙启动单元
+  ansible.builtin.copy:
+    dest: /etc/systemd/system/oci-wg-firewall.service
+    mode: '0644'
+    content: |
+      [Unit]
+      Description=OCI WireGuard scoped forwarding (no NAT)
+      After=network-pre.target
+      Before=wg-quick@{{ wg_interface }}.service
+      [Service]
+      Type=oneshot
+      ExecStart=/usr/local/sbin/oci-wg-firewall
+      RemainAfterExit=yes
+      [Install]
+      WantedBy=multi-user.target
+  notify: 刷新专用防火墙
+
+- name: 启动防火墙规则
+  ansible.builtin.systemd_service:
+    name: oci-wg-firewall
+    daemon_reload: true
+    enabled: true
+    state: started
+  when: not ansible_check_mode
+
+- name: 写入只含公钥的隧道配置
+  ansible.builtin.template:
+    src: wg.conf.j2
+    dest: '/etc/wireguard/{{ wg_interface }}.conf'
+    owner: root
+    group: root
+    mode: '0600'
+  when: wg_key_file.stat.exists and (hostvars[wg_peer_host].wg_key_file | default({"stat":{"exists":false}})).stat.exists
+  notify: 重启 WireGuard
+
+- name: 启动 WireGuard
+  ansible.builtin.systemd_service:
+    name: 'wg-quick@{{ wg_interface }}'
+    enabled: true
+    state: started
+  when: not ansible_check_mode
+
+- name: 写入受管 BGP 增量配置
+  ansible.builtin.template:
+    src: bgp.conf.j2
+    dest: /etc/frr/oci-wireguard.vtysh
+    owner: frr
+    group: frr
+    mode: '0640'
+  notify: 应用 BGP 增量配置
+  when: not ansible_check_mode or not packages.changed
+
+- name: 先完成配置变更再验证
+  ansible.builtin.meta: flush_handlers
+
+- name: 检查 WireGuard 对端握手
+  ansible.builtin.command: 'wg show {{ wg_interface }} latest-handshakes'
+  changed_when: false
+  register: wg_handshake
+  retries: 12
+  delay: 5
+  until: wg_handshake.stdout.split() | length == 2 and (wg_handshake.stdout.split()[-1] | int) > 0
+  when: not ansible_check_mode
+
+- name: 验证隧道互通
+  ansible.builtin.command: "{{ ('ping -6 -I ' ~ wg_interface ~ ' -c 3 -W 3 ' ~ bgp_transport_peer) if bgp_transport_peer is defined else ('ping -I ' ~ wg_interface ~ ' -c 3 -W 3 ' ~ wg_peer_address) }}"
+  changed_when: false
+  when: not ansible_check_mode
+
+- name: 验证 BGP 建邻并收到预期前缀数量
+  ansible.builtin.command: vtysh -c 'show bgp summary json'
+  changed_when: false
+  register: bgp_summary
+  retries: 12
+  delay: 5
+  until: >-
+    (bgp_summary.stdout | from_json).get('ipv4Unicast', {}).get('peers', {}).get(bgp_transport_peer | default(wg_peer_address), {}).get('state') == 'Established'
+    and (bgp_summary.stdout | from_json).get('ipv4Unicast', {}).get('peers', {}).get(bgp_transport_peer | default(wg_peer_address), {}).get('pfxRcd', 0) == bgp_import | length
+  when: not ansible_check_mode
+
+- name: 验证 IPv6 iBGP 建邻与前缀
+  ansible.builtin.command: vtysh -c 'show bgp summary json'
+  changed_when: false
+  register: bgp_summary6
+  retries: 12
+  delay: 5
+  until: >-
+    (bgp_summary6.stdout | from_json).get('ipv6Unicast', {}).get('peers', {}).get(bgp_transport_peer | default(wg_peer_ipv6), {}).get('state') == 'Established'
+    and (bgp_summary6.stdout | from_json).get('ipv6Unicast', {}).get('peers', {}).get(bgp_transport_peer | default(wg_peer_ipv6), {}).get('pfxRcd', 0) == bgp_import6 | length
+  when: not ansible_check_mode and bgp_import6 is defined

infrastructure/oci/ansible/roles/wireguard_bgp/templates/bgp.conf.j2

@@ -0,0 +1,80 @@
+{% set v4_peer = bgp_transport_peer | default(wg_peer_address) %}
+{% set v6_peer = bgp_transport_peer | default(wg_peer_ipv6 | default("")) %}
+! vtysh -f 使用配置模式，write memory 由独立 handler 执行。
+! 只重建本角色拥有的邻居和过滤器，保留既有 BGP/OSPF。
+router bgp {{ bgp_asn }}
+ no neighbor {{ v4_peer }}
+{% for peer in bgp_retired_peers | default([]) %}
+ no neighbor {{ peer }}
+{% endfor %}
+exit
+no ip prefix-list OCI-WG-IN
+no ip prefix-list OCI-WG-OUT
+{% for prefix in bgp_import %}
+ip prefix-list OCI-WG-IN seq {{ loop.index * 10 }} permit {{ prefix }}
+{% endfor %}
+{% for prefix in bgp_export + (bgp_summary | default([])) %}
+ip prefix-list OCI-WG-OUT seq {{ loop.index * 10 }} permit {{ prefix }}
+{% endfor %}
+router bgp {{ bgp_asn }}
+ bgp router-id {{ bgp_router_id }}
+ neighbor {{ v4_peer }} remote-as {{ bgp_peer_asn }}
+ neighbor {{ v4_peer }} description OCI-WireGuard
+ neighbor {{ v4_peer }} update-source {{ wg_interface }}
+{% if bgp_transport_peer is defined %}
+ neighbor {{ v4_peer }} interface {{ wg_interface }}
+ neighbor {{ v4_peer }} capability extended-nexthop
+{% endif %}
+ address-family ipv4 unicast
+{% for prefix in bgp_summary | default([]) %}
+  aggregate-address {{ prefix }}
+{% endfor %}
+{% for prefix in bgp_export %}
+  network {{ prefix }}
+{% endfor %}
+  neighbor {{ v4_peer }} activate
+  neighbor {{ v4_peer }} prefix-list OCI-WG-IN in
+  neighbor {{ v4_peer }} prefix-list OCI-WG-OUT out
+  neighbor {{ v4_peer }} maximum-prefix {{ bgp_import | length }}
+ exit-address-family
+exit
+! 仅为这些 BGP 路由选择本机业务 IP；转发报文源地址保持不变，不是 NAT。
+route-map OCI-WG-SOURCE permit 10
+ match ip address prefix-list OCI-WG-IN
+ set src {{ bgp_router_id }}
+exit
+route-map OCI-WG-SOURCE permit 100
+exit
+ip protocol bgp route-map OCI-WG-SOURCE
+
+{% if bgp_export6 is defined %}
+no ipv6 prefix-list OCI-WG6-IN
+no ipv6 prefix-list OCI-WG6-OUT
+{% for prefix in bgp_import6 %}
+ipv6 prefix-list OCI-WG6-IN seq {{ loop.index * 10 }} permit {{ prefix }}
+{% endfor %}
+{% for prefix in bgp_export6 + (bgp_summary6 | default([])) %}
+ipv6 prefix-list OCI-WG6-OUT seq {{ loop.index * 10 }} permit {{ prefix }}
+{% endfor %}
+router bgp {{ bgp_asn }}
+ neighbor {{ v6_peer }} remote-as {{ bgp_peer_asn }}
+ neighbor {{ v6_peer }} update-source {{ wg_interface }}
+{% if bgp_transport_peer is not defined %}
+ address-family ipv4 unicast
+  no neighbor {{ v6_peer }} activate
+ exit-address-family
+{% endif %}
+ address-family ipv6 unicast
+{% for prefix in bgp_summary6 | default([]) %}
+  aggregate-address {{ prefix }}
+{% endfor %}
+{% for prefix in bgp_export6 %}
+  network {{ prefix }}
+{% endfor %}
+  neighbor {{ v6_peer }} activate
+  neighbor {{ v6_peer }} prefix-list OCI-WG6-IN in
+  neighbor {{ v6_peer }} prefix-list OCI-WG6-OUT out
+  neighbor {{ v6_peer }} maximum-prefix {{ bgp_import6 | length }}
+ exit-address-family
+exit
+{% endif %}

infrastructure/oci/ansible/roles/wireguard_bgp/templates/firewall.sh.j2

@@ -0,0 +1,43 @@
+#!/bin/sh
+set -eu
+# 仅重建专用链，不保存/覆盖 Docker、k3s、Tailscale 或 OCI 的其他动态规则。
+for chain in OCI-WG-IN OCI-WG-FWD; do
+  iptables -w -nL "$chain" >/dev/null 2>&1 || iptables -w -N "$chain"
+  iptables -w -F "$chain"
+done
+iptables -w -A OCI-WG-IN -p udp --dport {{ wg_port }} -j ACCEPT
+{% for prefix in [wg_peer_address ~ '/32'] + bgp_import %}
+iptables -w -A OCI-WG-IN -i {{ wg_interface }} -s {{ prefix }} -j ACCEPT
+{% endfor %}
+{% for local_prefix in bgp_export %}
+{% for remote_prefix in bgp_import %}
+iptables -w -A OCI-WG-FWD -i {{ wg_interface }} -o {{ wg_lan_interface }} -s {{ remote_prefix }} -d {{ local_prefix }} -j ACCEPT
+iptables -w -A OCI-WG-FWD -i {{ wg_lan_interface }} -o {{ wg_interface }} -s {{ local_prefix }} -d {{ remote_prefix }} -j ACCEPT
+{% endfor %}
+{% endfor %}
+{% if dn42_external_interface is defined %}
+# 仅允许注册地址在内部隧道与外部 DN42 之间转发，保持无 NAT。
+iptables -w -A OCI-WG-FWD -i {{ wg_interface }} -o {{ dn42_external_interface }} -s {{ dn42_ipv4 }} -d 172.20.0.0/14 -j ACCEPT
+iptables -w -A OCI-WG-FWD -i {{ dn42_external_interface }} -o {{ wg_interface }} -s 172.20.0.0/14 -d {{ dn42_ipv4 }} -j ACCEPT
+{% endif %}
+iptables -w -A OCI-WG-FWD -i {{ wg_interface }} -j DROP
+iptables -w -A OCI-WG-FWD -o {{ wg_interface }} -j DROP
+iptables -w -C INPUT -j OCI-WG-IN 2>/dev/null || iptables -w -I INPUT 1 -j OCI-WG-IN
+iptables -w -C FORWARD -j OCI-WG-FWD 2>/dev/null || iptables -w -I FORWARD 1 -j OCI-WG-FWD
+
+{% if bgp_import6 is defined %}
+ip6tables -w -nL OCI-WG6-IN >/dev/null 2>&1 || ip6tables -w -N OCI-WG6-IN
+ip6tables -w -F OCI-WG6-IN
+ip6tables -w -A OCI-WG6-IN -i {{ wg_interface }} -s {{ dn42_ipv6 }} -j ACCEPT
+ip6tables -w -C INPUT -j OCI-WG6-IN 2>/dev/null || ip6tables -w -I INPUT 1 -j OCI-WG6-IN
+{% endif %}
+
+{% if dn42_external_interface is defined %}
+ip6tables -w -nL OCI-DN42-FWD >/dev/null 2>&1 || ip6tables -w -N OCI-DN42-FWD
+ip6tables -w -F OCI-DN42-FWD
+ip6tables -w -A OCI-DN42-FWD -i {{ wg_interface }} -o {{ dn42_external_interface }} -s {{ dn42_ipv6 }} -d fd00::/8 -j ACCEPT
+ip6tables -w -A OCI-DN42-FWD -i {{ dn42_external_interface }} -o {{ wg_interface }} -s fd00::/8 -d {{ dn42_ipv6 }} -j ACCEPT
+ip6tables -w -A OCI-DN42-FWD -i {{ dn42_external_interface }} -j DROP
+ip6tables -w -A OCI-DN42-FWD -o {{ dn42_external_interface }} -j DROP
+ip6tables -w -C FORWARD -j OCI-DN42-FWD 2>/dev/null || ip6tables -w -I FORWARD 1 -j OCI-DN42-FWD
+{% endif %}

infrastructure/oci/ansible/roles/wireguard_bgp/templates/wg.conf.j2

@@ -0,0 +1,16 @@
+[Interface]
+Address = {{ wg_address }}{% if wg_ipv6_address is defined %}, {{ wg_ipv6_address }}, {{ wg_linklocal_address }}{% endif %}
+
+ListenPort = {{ wg_port }}
+MTU = {{ wg_mtu }}
+Table = off
+# 私钥在本机生成和读取；配置模板与控制机不保存私钥。
+PostUp = wg set %i private-key /etc/wireguard/{{ wg_interface }}.key
+
+[Peer]
+PublicKey = {{ hostvars[wg_peer_host].wg_public_key.stdout }}
+AllowedIPs = {{ ([wg_peer_address ~ '/32'] + bgp_import + (bgp_import6 | default([])) + (['fe80::/64'] if bgp_import6 is defined else [])) | join(', ') }}
+{% if wg_endpoint %}
+Endpoint = {{ wg_endpoint }}
+{% endif %}
+PersistentKeepalive = {{ wg_keepalive }}

infrastructure/oci/ansible/site.yml

@@ -0,0 +1,52 @@
+---
+- import_playbook: vyos.yml
+
+- name: 配置无 NAT 的 WireGuard 与 BGP 站点互联
+  hosts: wireguard_sites
+  become: true
+  strategy: linear
+  roles:
+    - wireguard_bgp
+
+- name: 为 OCI ARM 设置经 AMD 的站点回程，保留其余 Tailscale 路由
+  hosts: oci_routed_hosts
+  become: true
+  tasks:
+    - name: 安装三个目标网段的策略路由脚本
+      ansible.builtin.template:
+        src: templates/arm-routes.sh.j2
+        dest: /usr/local/sbin/oci-site-return-routes
+        mode: '0755'
+      notify: 更新 OCI ARM 回程
+
+    - name: 安装回程策略启动单元
+      ansible.builtin.copy:
+        dest: /etc/systemd/system/oci-site-return-routes.service
+        mode: '0644'
+        content: |
+          [Unit]
+          Description=Route homelab prefixes through OCI AMD rather than Tailscale
+          After=network-online.target
+          Wants=network-online.target
+          [Service]
+          Type=oneshot
+          ExecStart=/usr/local/sbin/oci-site-return-routes
+          RemainAfterExit=yes
+          [Install]
+          WantedBy=multi-user.target
+      notify: 更新 OCI ARM 回程
+
+    - name: 启用回程策略
+      ansible.builtin.systemd_service:
+        name: oci-site-return-routes
+        daemon_reload: true
+        enabled: true
+        state: started
+      when: not ansible_check_mode
+  handlers:
+    - name: 更新 OCI ARM 回程
+      ansible.builtin.systemd_service:
+        name: oci-site-return-routes
+        daemon_reload: true
+        state: restarted
+      when: not ansible_check_mode

infrastructure/oci/ansible/tasks/frr-dn42.yml

@@ -0,0 +1,38 @@
+---
+- name: 备份升级前 FRR 配置（仅远端）
+  ansible.builtin.command: cp -a /etc/frr /var/backups/frr-before-dn42
+  args:
+    creates: /var/backups/frr-before-dn42
+- name: 安装 FRR 官方仓库签名密钥
+  ansible.builtin.get_url:
+    url: https://deb.frrouting.org/frr/keys.gpg
+    dest: /usr/share/keyrings/frrouting.gpg
+    mode: '0644'
+- name: 配置 FRR 10.7 官方仓库
+  ansible.builtin.copy:
+    dest: /etc/apt/sources.list.d/frr.list
+    mode: '0644'
+    content: |
+      deb [signed-by=/usr/share/keyrings/frrouting.gpg] https://deb.frrouting.org/frr noble frr-10.7
+  register: frr_repo
+- name: 安装支持 link-local peering 的固定 FRR 版本
+  ansible.builtin.apt:
+    name:
+      - frr=10.7.1-0~ubuntu24.04.1
+      - frr-pythontools=10.7.1-0~ubuntu24.04.1
+    update_cache: true
+    cache_valid_time: '{{ 0 if frr_repo.changed else 3600 }}'
+    dpkg_options: force-confdef,force-confold
+  register: frr_package
+  notify: 重启 FRR
+- name: 检查 FRR 后台进程是否仍引用旧二进制
+  ansible.builtin.shell: readlink /proc/$(cat /run/frr/bgpd.pid)/exe
+  changed_when: false
+  register: frr_running
+- name: 调度切换已升级的 FRR 进程
+  ansible.builtin.debug:
+    msg: 检查进程是否需要重启以使用已安装的 10.7.1
+  changed_when: "'(deleted)' in frr_running.stdout"
+  notify: 重启 FRR
+- name: 完成 FRR 升级
+  ansible.builtin.meta: flush_handlers

infrastructure/oci/ansible/templates/arm-routes.sh.j2

@@ -0,0 +1,9 @@
+#!/bin/sh
+set -eu
+# 5101..5103 保留给此互联，优先于 Tailscale 的 52 表（规则 5270）。
+# 主表仍使用 OCI 网关；VCN 路由表再将这三个前缀交给 AMD。
+{% for prefix in wg_home_prefixes %}
+if ! ip -4 rule show | grep -F 'to {{ prefix }} lookup main' >/dev/null; then
+  ip -4 rule add priority {{ 5100 + loop.index }} to {{ prefix }} lookup main
+fi
+{% endfor %}

infrastructure/oci/ansible/templates/dn42-bgp.conf.j2

@@ -0,0 +1,62 @@
+! Ansible 管理：首个 DN42 peer，单 IPv6 会话双 AFI。
+! 精确出口与地址范围入口；尚未接入注册表 ROA 校验。
+no ip prefix-list DN42-RB-IN
+ip prefix-list DN42-RB-IN seq 1 deny 172.22.166.0/24 le 32
+ip prefix-list DN42-RB-IN seq 5 deny 172.21.111.160/27 le 32
+ip prefix-list DN42-RB-IN seq 10 deny 10.0.0.0/24 le 32
+ip prefix-list DN42-RB-IN seq 20 deny 10.60.0.0/24 le 32
+ip prefix-list DN42-RB-IN seq 30 deny 10.61.0.0/24 le 32
+ip prefix-list DN42-RB-IN seq 40 deny 192.168.10.0/24 le 32
+ip prefix-list DN42-RB-IN seq 1001 permit 172.20.0.0/24 ge 28 le 32
+ip prefix-list DN42-RB-IN seq 1002 permit 172.21.0.0/24 ge 28 le 32
+ip prefix-list DN42-RB-IN seq 1003 permit 172.22.0.0/24 ge 28 le 32
+ip prefix-list DN42-RB-IN seq 1004 permit 172.23.0.0/24 ge 28 le 32
+ip prefix-list DN42-RB-IN seq 1100 permit 172.20.0.0/14 ge 21 le 29
+ip prefix-list DN42-RB-IN seq 2001 permit 10.100.0.0/14 le 32
+ip prefix-list DN42-RB-IN seq 2002 permit 10.127.0.0/16 le 32
+ip prefix-list DN42-RB-IN seq 2003 permit 10.0.0.0/8 ge 15 le 24
+ip prefix-list DN42-RB-IN seq 3001 permit 172.31.0.0/16 le 32
+ip prefix-list DN42-RB-IN seq 9999 deny 0.0.0.0/0 le 32
+ip prefix-list DN42-RB-OUT seq 10 permit 172.21.111.160/27
+no ipv6 prefix-list DN42-RB6-IN
+ipv6 prefix-list DN42-RB6-IN seq 5 deny fdd0:98df:15b0::/48 le 128
+ipv6 prefix-list DN42-RB6-IN seq 1001 permit fd00::/8 ge 44 le 64
+ipv6 prefix-list DN42-RB6-IN seq 9999 deny ::/0 le 128
+ipv6 prefix-list DN42-RB6-OUT seq 10 permit fdd0:98df:15b0::/48
+interface {{ dn42_interface }}
+exit
+router bgp 4242421811
+ no neighbor {{ dn42_peer_linklocal }}
+ neighbor {{ dn42_peer_linklocal }} remote-as {{ dn42_peer_asn }}
+ neighbor {{ dn42_peer_linklocal }} shutdown
+ neighbor {{ dn42_peer_linklocal }} interface {{ dn42_interface }}
+ neighbor {{ dn42_peer_linklocal }} update-source {{ dn42_interface }}
+ neighbor {{ dn42_peer_linklocal }} description RoutedBits-OSA1
+ neighbor {{ dn42_peer_linklocal }} capability extended-nexthop
+ neighbor {{ dn42_peer_linklocal }} timers connect 10
+ address-family ipv4 unicast
+  neighbor {{ dn42_peer_linklocal }} activate
+  neighbor {{ dn42_peer_linklocal }} prefix-list DN42-RB-IN in
+  neighbor {{ dn42_peer_linklocal }} prefix-list DN42-RB-OUT out
+  neighbor {{ dn42_peer_linklocal }} maximum-prefix 10000
+ exit-address-family
+ address-family ipv6 unicast
+  neighbor {{ dn42_peer_linklocal }} activate
+  neighbor {{ dn42_peer_linklocal }} prefix-list DN42-RB6-IN in
+  neighbor {{ dn42_peer_linklocal }} prefix-list DN42-RB6-OUT out
+  neighbor {{ dn42_peer_linklocal }} maximum-prefix 10000
+ exit-address-family
+ no neighbor {{ dn42_peer_linklocal }} shutdown
+exit
+! 保留既有业务源地址规则，在其后为 DN42 路由选择注册地址；不是 NAT。
+route-map OCI-WG-SOURCE permit 20
+ match ip address prefix-list DN42-RB-IN
+ set src 172.21.111.162
+exit
+route-map DN42-SOURCE6 permit 10
+ match ipv6 address prefix-list DN42-RB6-IN
+ set src fdd0:98df:15b0::2
+exit
+route-map DN42-SOURCE6 permit 100
+exit
+ipv6 protocol bgp route-map DN42-SOURCE6

infrastructure/oci/ansible/templates/vyos-dn42-dns.conf.j2

@@ -0,0 +1,14 @@
+set service dns forwarding listen-address '192.168.10.2'
+set service dns forwarding source-address '172.21.111.161'
+set service dns forwarding source-address 'fdd0:98df:15b0::1'
+set service dns forwarding no-serve-rfc1918
+{% for prefix in wg_home_prefixes %}
+set service dns forwarding allow-from '{{ prefix }}'
+{% endfor %}
+{% for zone in dn42_dns_zones %}
+set service dns forwarding domain {{ zone }} recursion-desired
+set service dns forwarding domain {{ zone }} addnta
+{% for server in dn42_dns_servers %}
+set service dns forwarding domain {{ zone }} name-server '{{ server }}'
+{% endfor %}
+{% endfor %}