diff --git a/bin/zarya b/bin/zarya index 80148fe..c3da526 100755 --- a/bin/zarya +++ b/bin/zarya @@ -45,7 +45,7 @@ GitOps и оркестрация: z login [TTL] Открытие смены (YubiKey + RAM) z logout Мгновенная очистка RAM z unseal Распечатывание OpenBao Vault - z secret perimeter [cmd] Управление секретами периметра (ensure|show|rotate) + z secret kontur [cmd] Управление секретами периметра (ensure|show|rotate) Деплой и IaC: z up [layer] Макро-слои (host, net, tier0, talos, apps, all) z run Плейбуки Ansible (01, 02) diff --git a/cmd/net.sh b/cmd/net.sh index 0815aa8..96cfb9a 100755 --- a/cmd/net.sh +++ b/cmd/net.sh @@ -24,9 +24,9 @@ check_target() { check_target "Proxmox" "192.168.1.177" 8006 check_target "Vyos" "192.168.1.2" 22 -check_target "Technitium DNS" "10.0.10.11" 53 -check_target "OpenBao Vault" "10.0.10.12" 8200 -check_target "Forgejo GitOps" "10.0.10.13" 3000 -check_target "NFS Storage (NAS)" "10.0.10.14" 2049 -check_target "Traefik L2 VIP" "10.0.30.200" 443 -check_target "Perimeter VPS" "153.76.194.24" 443 +check_target "DNS" "10.0.10.11" 53 +check_target "Vault" "10.0.10.12" 8200 +check_target "Git" "10.0.10.13" 3000 +check_target "NAS" "10.0.10.14" 2049 +check_target "Traefik" "10.0.30.200" 443 +check_target "Kontur" "153.76.194.24" 443 diff --git a/cmd/secret.sh b/cmd/secret.sh index 8293814..99826bd 100755 --- a/cmd/secret.sh +++ b/cmd/secret.sh @@ -5,17 +5,17 @@ source "${ZARYA_DIR}/lib/common.sh" SUBCMD="${1:-}" shift || true case "${SUBCMD}" in - perimeter|srv) + kontur|srv) NODE="${1:-}" ACTION="${2:-ensure}" if [[ -z "${NODE}" ]]; then - log_err "Использование: z secret perimeter <нода> [ensure|show|rotate]" + log_err "Использование: z secret kontur <нода> [ensure|show|rotate]" exit 1 fi - run_isolated python3 "${ZARYA_DIR}/lib/perimeter_secrets.py" "${ACTION}" "${NODE}" + run_isolated python3 "${ZARYA_DIR}/lib/kontur_secrets.py" "${ACTION}" "${NODE}" ;; *) - log_err "Использование: z secret perimeter <нода> [ensure|show|rotate]" + log_err "Использование: z secret kontur <нода> [ensure|show|rotate]" exit 1 ;; esac diff --git a/config.env b/config.env index f22f0cc..c435ee3 100644 --- a/config.env +++ b/config.env @@ -5,7 +5,7 @@ RAM_KEY="/dev/shm/.atlas_core" VAULT_ADDR="http://10.0.10.12:8200" VYOS_ROUTER_IP="192.168.1.2" NET_PREFIX="10.0.0.0/16" -GIT_HOST="git.svo88.space" +GIT_HOST="git.svoo.tech" PVE_ENDPOINT="https://192.168.1.177:8006/" DEFAULT_SESSION_TTL=1 diff --git a/layers/00_host.sh b/layers/00_host.sh index 6a19dd7..39c07c0 100755 --- a/layers/00_host.sh +++ b/layers/00_host.sh @@ -5,7 +5,7 @@ ensure_prerequisites load_secrets_to_ram log_info "[Layer 0: PVE Host] Подготовка хоста, шаблонов и базовых директорий ZFS..." -ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/01_pve_host_day0.yml" +ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/01_pve.yml" log_info "[Layer 0: PVE Host] Инициализация compute-скелетов ВМ и LXC через OpenTofu..." cd "${REPO_ROOT}/tofu" && tofu apply \ @@ -21,6 +21,6 @@ cd "${REPO_ROOT}/tofu" && tofu apply \ -auto-approve log_info "[Layer 0: PVE Host] Применение постоянных ZFS-маунтов (mp) на созданные LXC..." -ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/01_pve_host_day0.yml" +ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/01_pve.yml" log_ok "Layer 0 готов: хост настроен, ВМ и LXC созданы, ZFS смонтирован." \ No newline at end of file diff --git a/layers/01_net.sh b/layers/01_net.sh index bda1d05..97fb96b 100755 --- a/layers/01_net.sh +++ b/layers/01_net.sh @@ -4,6 +4,6 @@ source "$(dirname "${BASH_SOURCE[0]}")/../lib/common.sh" ensure_prerequisites load_secrets_to_ram -log_info "[Layer 1: VyOS & Perimeter] Накатка конфигурации сети..." -ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/02_vyos_network_day0.yml" +log_info "[Layer 1: VyOS & Kontur] Накатка конфигурации сети..." +ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/02_vyos.yml" log_ok "Layer 1 готов." \ No newline at end of file diff --git a/layers/02_tier0.sh b/layers/02_tier0.sh index 9bc6828..84a8501 100755 --- a/layers/02_tier0.sh +++ b/layers/02_tier0.sh @@ -5,7 +5,7 @@ ensure_prerequisites load_secrets_to_ram log_info "[Layer 2: Tier-0 Air-Gap] Развертывание базовой инфраструктуры (Registry, DNS, Vault)..." -for pb in 03_zot_registry.yml 04_technitium_dns.yml 05_openbao_vault.yml; do +for pb in 03_reg.yml 04_dns.yml 05_vault.yml; do ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/${pb}" done @@ -16,7 +16,7 @@ log_info "[Layer 2: Tier-0 Air-Gap] Наполнение Vault секретам cd "${REPO_ROOT}/tofu" && tofu apply -auto-approve log_info "[Layer 2: Tier-0 Air-Gap] Развертывание зависимых сервисов (Forgejo, NAS Storage)..." -for pb in 06_forgejo_git.yml 07_nas_storage.yml; do +for pb in 06_git.yml 07_nas.yml; do ansible-playbook -i "${REPO_ROOT}/ansible/inventory.yml" "${REPO_ROOT}/ansible/playbooks/${pb}" done diff --git a/lib/perimeter_secrets.py b/lib/kontur_secrets.py similarity index 97% rename from lib/perimeter_secrets.py rename to lib/kontur_secrets.py index bfddb6e..3d160e8 100644 --- a/lib/perimeter_secrets.py +++ b/lib/kontur_secrets.py @@ -22,7 +22,7 @@ if not vault_token: sys.stderr.write("VAULT_TOKEN not found in environment\n") sys.exit(1) -endpoint = f"{vault_addr}/v1/secret/data/perimeter/{node}" +endpoint = f"{vault_addr}/v1/secret/data/kontur/{node}" existing_data = None req_get = urllib.request.Request(endpoint, headers={"X-Vault-Token": vault_token}) @@ -76,7 +76,7 @@ payload = { "reality_private_key": v_priv, "reality_public_key": v_pub, "reality_short_id": secrets.token_hex(4), - "reality_server_name": "ng.w.svo88.space", + "reality_server_name": "sss.svoo.tech", "awg_server_private_key": awg_s_priv, "awg_server_public_key": awg_s_pub, "awg_router_private_key": awg_r_priv, diff --git a/state/00_workstation.sh b/state/00_workstation.sh index 9d3bf50..afd2aa1 100755 --- a/state/00_workstation.sh +++ b/state/00_workstation.sh @@ -32,9 +32,9 @@ else fi echo '```' -echo "### Проверка Git Credential Helper (git.svo88.space):" +echo "### Проверка Git Credential Helper (git.svoo.tech):" echo '```text' -printf "protocol=https\nhost=git.svo88.space\n" | git credential fill 2>&1 | awk -F= '/^username/ {print "Username:", $2} /^password/ {print "Password: [PRESENT in RAM]"}' || echo "Credential helper не вернул учетных данных" +printf "protocol=https\nhost=git.svoo.tech\n" | git credential fill 2>&1 | awk -F= '/^username/ {print "Username:", $2} /^password/ {print "Password: [PRESENT in RAM]"}' || echo "Credential helper не вернул учетных данных" echo '```' echo "### Ядро, память, ZRAM и параметры Coredump:" diff --git a/state/04_tier0.sh b/state/04_tier0.sh index cb4d5c4..7dd1172 100755 --- a/state/04_tier0.sh +++ b/state/04_tier0.sh @@ -4,7 +4,7 @@ SSH_VYOS="ssh -n -o BatchMode=yes -o ConnectTimeout=3 vyos" SSH_STORAGE="ssh -n -o BatchMode=yes -o ConnectTimeout=3 -J vyos nas.t0" echo "## 4. Сервисы Tier-0 (Air-Gap фундамент)" echo "### Technitium DNS (10.0.10.11:53):" -echo "* **Внутренний домен (*.svo88.space -> 10.0.30.200):** $(timeout 3s ${SSH_VYOS} "dig @10.0.10.11 vw.svo88.space +short" 2>&1 | tr '\n' ' ')" +echo "* **Внутренний домен (*.svoo.tech -> 10.0.30.200):** $(timeout 3s ${SSH_VYOS} "dig @10.0.10.11 vw.svoo.tech +short" 2>&1 | tr '\n' ' ')" echo "* **Внешний резолв (google.com):** $(timeout 3s ${SSH_VYOS} "dig @10.0.10.11 google.com +short" 2>&1 | head -n1)" echo "### OpenBao Vault (10.0.10.12:8200):" echo '```json'