20-JUL-2024

2307

Overall today I’ve got toto, nancy, and archimedes all on the 10.255.0.0/16 network, mostly manually configured. I need to build the deploy script in elenta and get the netboot image generation and direct configuration application working.

I saw a recurrence of an old issue where ssh connections hang after some amount of time, I think it relates to old DHCP leases, and I believe I’ve resolved it.

The other thing I am missing is some tooling to manage the switches. I’m hopeful I can repair the old switch which died (prompting all this work happening so suddenly, I had planned a more gentle transition), but I need a way to better manage the switch configuration, so I’d like to add tooling in elenta to manage that as well.

In the short term I may just port flying-monkey and build-img from ereshkigal and serve them out of elenta; elenta can pull in narya and telperion and provide a version of flying-monkey to manually manage machines based on their canon address. I’d like to improve the ergonomics to just need the canon name of the machine, then have it look up the IP at least optionally without relying on DNS.

I can also have it introspect and get the MAC of the relevant machine for image building, the CLI should be something like:

# Build an image and place it at the specified location
$ elenta build-image --config '.#machine-role' --out /path/to/store/image
# Build an image for the given MAC, store it under that MAC in the given 'store'
$ elenta build-image --config '.#machine-role' --mac 00:11:22:33:44:55 --store /path/to/netboot/store
# Build an image for the given machine by it's canon, with the given role.
$ elenta build-image --config '.#machine-role' --canon 'machine.canon' --store /path/to/netboot/store

# Deploy a role to a machine by it's canon name, do not boot to it on reboot (equiv to `nixos-rebuild test`)
$ elenta deploy --config '.#machine-role' --canon 'machine.canon'
# Deploy a role to a machine and set it to boot to it on reboot (equiv to `nixos-rebuild switch`)
$ elenta switch --config '.#machine-role' --canon 'machine.canon'

# Optionally use `--no-dns` to look up the mapping directly in telperion (useful for IP changes)
$ elenta deploy --config '.#machine-role' --canon 'machine.canon' --no-dns

elenta is going to have a concept of constellations, which I suppose are similar to helm charts or compose files, excepting that it’s a mapping of machine roles to machines, and expects that configurations support whatever other systems you want to run.

The upshot of these is that you gain a separation between arbitrary physical hardware and the logical design of your architecture. You can spend all your time designing an entirely abstract architecture, and then distribute roles to machines independently.

The API I think looks a bit like

# Note this is a sketch, I don't think you can import flake components like that.
rec {
    roles = {
        reverse-proxy = import "flake:telperion#domains.example.tld.roles.reverse-proxy";
        app-server = import "flake:telperion#domains.example.tld.roles.app-server";
        database = import "flake:telperion#domains.example.tld.roles.database";
    };
    mapping = {
        domain = "example.tld";
        redirect_bare_to = "www";
        machines = {
            "www" = {
                role = roles.reverse-proxy;
                host = "server-a.canon";
                extraOpts = {
                    # Arbitrary extra options to pass to the role
                };
            };
            "app" = {
                role = roles.app-server;
                # Since these two are on the same machine, the mapping will try to merge the two
                # configurations, if they can't be merged, it will fail with an error.
                host = "server-a.canon";
            };

            # Here we might assume that the roles have modes which tell it how to look for other db
            # instances, again, the goal of this is to try to only think about the allocation of
            # roles to hardware, and only pass information as is strictly necessary.
            "db-a" = {
                role = roles.database;
                host = "server-b.canon";
                extraOpts = {
                    mode = "primary";
                };
            };
            "db-b" = {
                role = roles.database;
                host = "server-c.canon";
                extraOpts = {
                    mode = "secondary";
                };
            };

        }
    };
}

elenta will have access to the full mapping and can pass that down to the role configurations, so roles can look up items in the constellation and use that for static service discovery; elenta can also use this mapping to generate DNS configuration that creates a zonefile for the particular domain that creates all the necessary records.

Eventually it’d be cool to include switch configurations as well.