RWejlgaard/pez-infra
1
0
Fork 0
mirror of https://github.com/RWejlgaard/pez-infra.git synced 2026-11-01 03:21:02 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2
pez-infra/docs/hosts/copenhagen-a.md
Rasmus "Pez" Wejlgaard 07d59579d3
Some checks are pending
Deploy (on merge + daily) / Discover hosts (push) Waiting to run
Details
Deploy (on merge + daily) / deploy (push) Blocked by required conditions
Details
Back up the Proxmox VMs to london-b (#151) 
Neither Proxmox host had a single backup job, so the game servers, the
k3s control planes and the workspace VMs had no backups at all.

copenhagen-a has nowhere local to keep them (`local` is the root LV and
already 82% full), so both hosts now back up to a new pve-backups Samba
share on london-b, each into its own directory. VMIDs overlap between
the two hosts, and retention prunes by VMID, so they can't share one.

- media_stack creates a Samba-only pvebackup user on london-b, the share
  and the per-host directories. The password comes from SOPS and gets
  re-set if the login stops working. smb.conf is now checked with
  testparm before it's deployed.
- proxmox_ve adds a backup-only london-b-backups CIFS storage, pushes the
  credentials again if the storage goes inactive, and fails the deploy
  if it still can't reach london-b.
- Jobs are defined in host_vars. Each job keeps a hash of its settings
  in its comment, so the role only touches jobs that changed and removes
  ones I delete from host_vars. Jobs made by hand are left alone.

london-a backs up the control plane every night. copenhagen-a backs up
the control plane and game servers every night and the workspace VMs
weekly, since every run is a full archive going over the WAN.
2026-09-17 17:12:16 +01:00

3.5 KiB
Raw Blame History

copenhagen-a

Proxmox VE hypervisor. Located at my dad's place in Copenhagen as an off-site location — the Copenhagen counterpart to london-a.

Overview
Location Copenhagen
OS Debian 13 (Trixie) with Proxmox VE
Tailscale IP 100.91.240.29
Role Hypervisor (Proxmox VE)
Form factor Minisforum MS-A2 mini PC

Hardware

Component Spec
CPU AMD Ryzen 9 9955HX (16 cores / 32 threads)
Memory 64 GB
Boot disk 1 TB NVMe (Kingston OM8TAP41024K1-A00)

Minisforum MS-A2 mini PC. Small, quiet, and draws minimal power relative to its performance. This replaced the original Lenovo "tiny" desktop (Intel i5-4570T / 16 GB / 500 GB) that used to run the gaming servers directly on bare metal; the host was repaved as Proxmox VE on the new hardware.

Services

Service Port Status Notes
Proxmox VE 8006 Active Web UI — reachable via copenhagen-a.pez.sh (Caddy) or Tailscale IP
Tailscale — Active Mesh networking
node_exporter, systemd_exporter, Alloy — Active Observability baseline (Ansible-managed)

Storage

Unlike london-a, this host does not mount london-b's /pve CIFS share — it's not worth the WAN/Tailscale hop from Copenhagen for VM storage. It does use london-b for backups (below). Only local storage is configured (proxmox_ve_mount_cifs_storage: false in host_vars/copenhagen-a.yml).

Storage ID Type Backing
local-lvm LVM-Thin Local boot disk
local Directory ISO/template storage
london-b-backups CIFS london-b pve-backups share over Tailscale, /copenhagen-a subdir — backups only

Backups

There's no room for backups locally, so they go to london-b over Tailscale. Every vzdump run is a full archive, so only the VMs that change daily run nightly. Jobs are defined in proxmox_ve_backup_jobs in host_vars/copenhagen-a.yml:

Job Schedule VMs Retention
daily 03:00 100 (k8s-control-plane), 102 (minecraft), 103 (mangos-zero) 7 daily, 4 weekly
weekly Sun 04:30 101 (workspace), 104 (workspace-alpine) 4 weekly

VMs

Runs a mix of always-on VMs (Kubernetes control plane, a general-purpose workspace, Minecraft) plus Karpenter-managed Kubernetes worker nodes that scale up/down on demand.

Ansible

Part of the proxmox_hosts group alongside london-a, sharing the proxmox_ve role:

  • Swaps the enterprise apt repo for pve-no-subscription so updates work without a paid subscription
  • Patches proxmoxlib.js to suppress the subscription nag dialog
  • Restricts the web UI to the tailscale0 interface via UFW
  • Skips the london-b /pve CIFS mount (proxmox_ve_mount_cifs_storage: false)
  • Adds the london-b-backups storage and reconciles the vzdump jobs in proxmox_ve_backup_jobs

Networking

Connected directly to the ISP router's built-in switch. Symmetrical 500 Mbit connection.

History

copenhagen-a used to run gaming servers directly on bare metal: a Minecraft server (itzg/minecraft-server, Docker) and a WoW 1.12 (Vanilla) MaNGOS Zero private server (native systemd + local MariaDB). Both were decommissioned and the host was repaved as Proxmox VE — the Tailscale identity (and IP) changed as part of the reinstall. The old static public IP used for direct game-client connections (Minecraft server list, WoW realm list) is no longer needed since nothing here accepts direct client connections anymore.