forked from cerc-io/stack-orchestrator
Playbook fixes from testing: - ashburn-relay-biscayne: insert DNAT rules at position 1 before Docker's ADDRTYPE LOCAL rule (was being swallowed at position 3+) - ashburn-relay-mia-sw01: add inbound route for 137.239.194.65 via egress-vrf vrf1 (nexthop only, no interface — EOS silently drops cross-VRF routes that specify a tunnel interface) - ashburn-relay-was-sw01: replace PBR with static route, remove Loopback101 Bug doc (bug-ashburn-tunnel-port-filtering.md): root cause is the DoubleZero agent on mia-sw01 overwrites SEC-USER-500-IN ACL, dropping outbound gossip with src 137.239.194.65. The DZ agent controls Tunnel500's lifecycle. Fix requires a separate GRE tunnel using mia-sw01's free LAN IP (209.42.167.137) to bypass DZ infrastructure. Also adds all repo docs, scripts, inventory, and remaining playbooks. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
108 lines
3.3 KiB
YAML
108 lines
3.3 KiB
YAML
---
|
|
# Configure biscayne OS-level services for agave validator
|
|
#
|
|
# Installs a systemd unit that formats and mounts the ramdisk on boot.
|
|
# /dev/ram0 loses its filesystem on reboot, so mkfs.xfs must run before
|
|
# the fstab mount. This unit runs before docker, ensuring the kind node's
|
|
# bind mounts always see the ramdisk.
|
|
#
|
|
# This playbook is idempotent — safe to run multiple times.
|
|
#
|
|
# Usage:
|
|
# ansible-playbook -i biscayne.vaasl.io, playbooks/biscayne-boot.yml
|
|
#
|
|
- name: Configure OS-level services for agave
|
|
hosts: all
|
|
gather_facts: false
|
|
become: true
|
|
vars:
|
|
ramdisk_device: /dev/ram0
|
|
ramdisk_mount: /srv/solana/ramdisk
|
|
accounts_dir: /srv/solana/ramdisk/accounts
|
|
|
|
tasks:
|
|
- name: Install ramdisk format service
|
|
copy:
|
|
dest: /etc/systemd/system/format-ramdisk.service
|
|
mode: "0644"
|
|
content: |
|
|
[Unit]
|
|
Description=Format /dev/ram0 as XFS for Solana accounts
|
|
DefaultDependencies=no
|
|
Before=local-fs.target
|
|
After=systemd-modules-load.service
|
|
ConditionPathExists={{ ramdisk_device }}
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/sbin/mkfs.xfs -f {{ ramdisk_device }}
|
|
|
|
[Install]
|
|
WantedBy=local-fs.target
|
|
register: unit_file
|
|
|
|
- name: Install ramdisk post-mount service
|
|
copy:
|
|
dest: /etc/systemd/system/ramdisk-accounts.service
|
|
mode: "0644"
|
|
content: |
|
|
[Unit]
|
|
Description=Create Solana accounts directory on ramdisk
|
|
After=srv-solana-ramdisk.mount
|
|
Requires=srv-solana-ramdisk.mount
|
|
|
|
[Service]
|
|
Type=oneshot
|
|
RemainAfterExit=yes
|
|
ExecStart=/bin/bash -c 'mkdir -p {{ accounts_dir }} && chown solana:solana {{ ramdisk_mount }} {{ accounts_dir }}'
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
register: accounts_unit
|
|
|
|
- name: Ensure fstab entry uses nofail
|
|
lineinfile:
|
|
path: /etc/fstab
|
|
regexp: '^{{ ramdisk_device }}\s+{{ ramdisk_mount }}'
|
|
line: '{{ ramdisk_device }} {{ ramdisk_mount }} xfs noatime,nodiratime,nofail,x-systemd.requires=format-ramdisk.service 0 0'
|
|
register: fstab_entry
|
|
|
|
- name: Reload systemd
|
|
systemd:
|
|
daemon_reload: true
|
|
when: unit_file.changed or accounts_unit.changed or fstab_entry.changed
|
|
|
|
- name: Enable ramdisk services
|
|
systemd:
|
|
name: "{{ item }}"
|
|
enabled: true
|
|
loop:
|
|
- format-ramdisk.service
|
|
- ramdisk-accounts.service
|
|
|
|
# ---- apply now if ramdisk not mounted ------------------------------------
|
|
- name: Check if ramdisk is mounted
|
|
command: mountpoint -q {{ ramdisk_mount }}
|
|
register: ramdisk_mounted
|
|
failed_when: false
|
|
changed_when: false
|
|
|
|
- name: Format and mount ramdisk now
|
|
shell: |
|
|
mkfs.xfs -f {{ ramdisk_device }}
|
|
mount {{ ramdisk_mount }}
|
|
mkdir -p {{ accounts_dir }}
|
|
chown solana:solana {{ ramdisk_mount }} {{ accounts_dir }}
|
|
when: ramdisk_mounted.rc != 0
|
|
|
|
# ---- verify --------------------------------------------------------------
|
|
- name: Verify ramdisk
|
|
command: df -hT {{ ramdisk_mount }}
|
|
register: ramdisk_df
|
|
changed_when: false
|
|
|
|
- name: Show ramdisk status
|
|
debug:
|
|
msg: "{{ ramdisk_df.stdout_lines }}"
|