RWejlgaard/pez-infra

Fork 0

mirror of https://github.com/RWejlgaard/pez-infra.git synced 2026-10-31 19:11:03 +00:00

Rasmus "Pez" Wejlgaard 07d59579d3

Deploy (on merge + daily) / Discover hosts (push) Waiting to run

Details

Deploy (on merge + daily) / deploy (push) Blocked by required conditions

Details

Back up the Proxmox VMs to london-b (#151 )

Neither Proxmox host had a single backup job, so the game servers, the
k3s control planes and the workspace VMs had no backups at all.

copenhagen-a has nowhere local to keep them (`local` is the root LV and
already 82% full), so both hosts now back up to a new pve-backups Samba
share on london-b, each into its own directory. VMIDs overlap between
the two hosts, and retention prunes by VMID, so they can't share one.

- media_stack creates a Samba-only pvebackup user on london-b, the share
  and the per-host directories. The password comes from SOPS and gets
  re-set if the login stops working. smb.conf is now checked with
  testparm before it's deployed.
- proxmox_ve adds a backup-only london-b-backups CIFS storage, pushes the
  credentials again if the storage goes inactive, and fails the deploy
  if it still can't reach london-b.
- Jobs are defined in host_vars. Each job keeps a hash of its settings
  in its comment, so the role only touches jobs that changed and removes
  ones I delete from host_vars. Jobs made by hand are left alone.

london-a backs up the control plane every night. copenhagen-a backs up
the control plane and game servers every night and the workspace VMs
weekly, since every run is a full archive going over the WAN.

2026-09-17 17:12:16 +01:00

2.5 KiB

Raw Blame History

london-a

Proxmox VE hypervisor. The platform for any VM workloads I want to run on owned hardware.

Overview


Location	London (NW9)
OS	Debian 13 (Trixie) with Proxmox VE 9.x
Tailscale IP	100.122.180.98
Role	Hypervisor (Proxmox VE)

Hardware

Component	Spec
CPU	Intel i7-4790K (8 threads)
Memory	32 GB
Boot disk	1 TB

Old gaming PC. Runs Proxmox VE on bare metal.

Services

Service	Port	Status	Notes
Proxmox VE	8006	Active	Web UI — reachable via `london-a.pez.sh` (Caddy) or Tailscale IP
Tailscale	—	Active	Mesh networking
node_exporter, systemd_exporter, Alloy	—	Active	Observability baseline (Ansible-managed)

Storage

Proxmox is connected to a CIFS share on london-b (100.84.65.101 /pve) for ISO/template/backup storage. The mount is configured by the proxmox_ve Ansible role:

Storage ID	Type	Backing
`local-lvm`	LVM-Thin	Local boot disk
`hdd`	CIFS	london-b `/pve` share
`london-b-backups`	CIFS	london-b `pve-backups` share, `/london-a` subdir — backups only

Backups

vzdump jobs are defined in proxmox_ve_backup_jobs in host_vars/london-a.yml and applied by the proxmox_ve role:

Job	Schedule	VMs	Retention
`daily`	02:30	101 (k8s-control-plane)	7 daily, 4 weekly

Karpenter worker VMs and the Karpenter template are not backed up.

VMs

VMID	Name	Status	Notes
100	Mac-Server	Stopped	macOS Sequoia VM (OpenCore bootloader). Intended for occasional macOS workloads.

The VM list will grow over time — this is a general-purpose hypervisor, not a single-VM appliance.

Ansible

The proxmox_ve role:

Swaps the enterprise apt repo for pve-no-subscription so updates work without a paid subscription
Patches proxmoxlib.js to suppress the subscription nag dialog
Restricts the web UI to the tailscale0 interface via UFW
Mounts the london-b CIFS storage
Adds the london-b-backups storage and reconciles the vzdump jobs in proxmox_ve_backup_jobs

Networking

Connected via Cat 5 to the Ubiquiti switch alongside london-b and london-c.

History

london-a used to run FreeBSD as a single-purpose monitoring host (Prometheus + Grafana). Monitoring moved to Grafana Cloud, the box was repaved as Proxmox VE, and the FreeBSD-specific Ansible has been removed.

2.5 KiB Raw Blame History