Update HashiCorp stack docs with cluster info
This commit is contained in:
+118
-70
@@ -1,106 +1,154 @@
|
|||||||
# HashiCorp Stack - hf-pdocker-01
|
# HashiCorp Stack - hobbs.farm
|
||||||
|
|
||||||
## Overview
|
## Overview
|
||||||
|
|
||||||
Production HashiCorp stack deployed on `hf-pdocker-01` (192.168.86.192) providing orchestration, service discovery, and secrets management.
|
Production HashiCorp stack providing container orchestration, service discovery, and secrets management across the hobbs.farm infrastructure.
|
||||||
|
|
||||||
## Components
|
## Cluster Architecture
|
||||||
|
|
||||||
| Service | Version | Port | UI URL |
|
|
||||||
|---------|---------|------|--------|
|
|
||||||
| Consul | 1.17.1 | 8500 | http://192.168.86.192:8500 |
|
|
||||||
| Nomad | 1.7.3 | 4646 | http://192.168.86.192:4646 |
|
|
||||||
| Vault | 1.15.4 | 8200 | http://192.168.86.192:8200 |
|
|
||||||
|
|
||||||
## Architecture
|
|
||||||
|
|
||||||
```
|
```
|
||||||
┌─────────────────────────────────────────────────────────┐
|
┌─────────────────────────────────────────────────────────────────────┐
|
||||||
│ hf-pdocker-01 (192.168.86.192) │
|
│ hobbs.farm Cluster │
|
||||||
├─────────────────────────────────────────────────────────┤
|
├────────────────────────────────┬────────────────────────────────────┤
|
||||||
│ Consul Server → Service Discovery, KV Store │
|
│ hf-pdocker-01 │ hf-pdocker-02 │
|
||||||
│ Nomad Server → Workload Orchestration │
|
│ 192.168.86.192 │ 192.168.86.45 │
|
||||||
│ Nomad Client → Runs containers │
|
│ (Primary) │ (Legacy) │
|
||||||
│ Vault Server → Secrets Management (Consul backend) │
|
├────────────────────────────────┼────────────────────────────────────┤
|
||||||
└─────────────────────────────────────────────────────────┘
|
│ Consul Server (Leader) │ Consul Client │
|
||||||
|
│ Nomad Server │ Nomad Client │
|
||||||
|
│ Nomad Client │ node_class: legacy │
|
||||||
|
│ Vault Server │ meta: disk_status=failing │
|
||||||
|
└────────────────────────────────┴────────────────────────────────────┘
|
||||||
```
|
```
|
||||||
|
|
||||||
## Nomad Host Volumes
|
## Services
|
||||||
|
|
||||||
| Volume Name | Path | Purpose |
|
| Service | Version | Port | Primary URL | Notes |
|
||||||
|-------------|------|---------|
|
|---------|---------|------|-------------|-------|
|
||||||
| media | /data/media | Shared media files (movies, tv, downloads) |
|
| Consul | 1.17.1 | 8500 | http://192.168.86.192:8500 | Service discovery, KV store |
|
||||||
|
| Nomad | 1.7.3 | 4646 | http://192.168.86.192:4646 | Container orchestration |
|
||||||
|
| Vault | 1.15.4 | 8200 | http://192.168.86.192:8200 | Secrets management |
|
||||||
|
|
||||||
|
## Deployed Jobs
|
||||||
|
|
||||||
|
### media-stack (service)
|
||||||
|
| Service | Port | Health | URL |
|
||||||
|
|---------|------|--------|-----|
|
||||||
|
| Jellyfin | 8096 | ✅ | http://192.168.86.192:8096 |
|
||||||
|
| Sonarr | 8989 | ✅ | http://192.168.86.192:8989 |
|
||||||
|
| Radarr | 7878 | ✅ | http://192.168.86.192:7878 |
|
||||||
|
| SABnzbd | 8082 | ✅ | http://192.168.86.192:8082 |
|
||||||
|
| NZBHydra2 | 5076 | ✅ | http://192.168.86.192:5076 |
|
||||||
|
| Jellyseerr | 5055 | ✅ | http://192.168.86.192:5055 |
|
||||||
|
|
||||||
|
### traefik (system)
|
||||||
|
| Service | Port | Health | URL |
|
||||||
|
|---------|------|--------|-----|
|
||||||
|
| HTTP | 80 | ✅ | Redirects to HTTPS |
|
||||||
|
| HTTPS | 443 | ✅ | Reverse proxy |
|
||||||
|
| Dashboard | 8088 | ✅ | http://192.168.86.192:8088 |
|
||||||
|
|
||||||
|
## Host Volumes (hf-pdocker-01)
|
||||||
|
|
||||||
|
| Volume | Path | Purpose |
|
||||||
|
|--------|------|---------|
|
||||||
|
| media | /data/media | Movies, TV, downloads |
|
||||||
| jellyfin-config | /data/configs/jellyfin | Jellyfin configuration |
|
| jellyfin-config | /data/configs/jellyfin | Jellyfin configuration |
|
||||||
| sonarr-config | /data/configs/sonarr | Sonarr configuration |
|
| sonarr-config | /data/configs/sonarr | Sonarr configuration |
|
||||||
| radarr-config | /data/configs/radarr | Radarr configuration |
|
| radarr-config | /data/configs/radarr | Radarr configuration |
|
||||||
| sabnzbd-config | /data/configs/sabnzbd | SABnzbd configuration |
|
| sabnzbd-config | /data/configs/sabnzbd | SABnzbd configuration |
|
||||||
| nzbhydra-config | /data/configs/nzbhydra | NZBHydra2 configuration |
|
| nzbhydra-config | /data/configs/nzbhydra | NZBHydra2 configuration |
|
||||||
| jellyseerr-config | /data/configs/jellyseerr | Jellyseerr configuration |
|
| jellyseerr-config | /data/configs/jellyseerr | Jellyseerr configuration |
|
||||||
|
| traefik-data | /data/traefik | Traefik certs & config |
|
||||||
|
|
||||||
## Vault Secrets Structure
|
## Vault Secrets
|
||||||
|
|
||||||
```
|
```
|
||||||
secret/
|
secret/
|
||||||
└── media/
|
├── media/
|
||||||
├── jellyfin
|
│ ├── jellyfin
|
||||||
├── sonarr
|
│ ├── sonarr
|
||||||
├── radarr
|
│ ├── radarr
|
||||||
├── sabnzbd
|
│ ├── sabnzbd
|
||||||
├── nzbhydra
|
│ ├── nzbhydra
|
||||||
└── jellyseerr
|
│ └── jellyseerr
|
||||||
```
|
└── traefik/
|
||||||
|
└── cloudflare (email, api_token)
|
||||||
## Deployed Jobs
|
|
||||||
|
|
||||||
### media-stack
|
|
||||||
Combined job running all media services:
|
|
||||||
- Jellyfin (8096) - Media streaming
|
|
||||||
- Sonarr (8989) - TV show management
|
|
||||||
- Radarr (7878) - Movie management
|
|
||||||
- SABnzbd (8082) - Usenet downloader
|
|
||||||
- NZBHydra2 (5076) - Indexer aggregator
|
|
||||||
- Jellyseerr (5055) - Media requests
|
|
||||||
|
|
||||||
## Commands
|
|
||||||
|
|
||||||
```bash
|
|
||||||
# Cluster status
|
|
||||||
consul members
|
|
||||||
nomad server members
|
|
||||||
nomad node status
|
|
||||||
vault status
|
|
||||||
|
|
||||||
# Job management
|
|
||||||
nomad job run <job.hcl>
|
|
||||||
nomad job status <job>
|
|
||||||
nomad job stop <job>
|
|
||||||
|
|
||||||
# View logs
|
|
||||||
nomad alloc logs <alloc-id>
|
|
||||||
|
|
||||||
# Vault secrets
|
|
||||||
export VAULT_ADDR='http://127.0.0.1:8200'
|
|
||||||
vault kv list secret/media/
|
|
||||||
vault kv get secret/media/<service>
|
|
||||||
```
|
```
|
||||||
|
|
||||||
## Configuration Files
|
## Configuration Files
|
||||||
|
|
||||||
|
### hf-pdocker-01 (Server)
|
||||||
| Service | Config Path |
|
| Service | Config Path |
|
||||||
|---------|-------------|
|
|---------|-------------|
|
||||||
| Consul | /etc/consul.d/consul.hcl |
|
| Consul | /etc/consul.d/consul.hcl |
|
||||||
| Nomad | /etc/nomad.d/nomad.hcl, client.hcl |
|
| Nomad | /etc/nomad.d/nomad.hcl, client.hcl |
|
||||||
| Vault | /etc/vault.d/vault.hcl |
|
| Vault | /etc/vault.d/vault.hcl |
|
||||||
|
|
||||||
## Systemd Services
|
### hf-pdocker-02 (Client)
|
||||||
|
| Service | Config Path |
|
||||||
|
|---------|-------------|
|
||||||
|
| Consul | /etc/consul.d/consul.hcl |
|
||||||
|
| Nomad | /etc/nomad.d/nomad.hcl, client.hcl |
|
||||||
|
|
||||||
|
## Operations
|
||||||
|
|
||||||
|
### Check Cluster Health
|
||||||
```bash
|
```bash
|
||||||
systemctl status consul nomad vault
|
# Consul cluster
|
||||||
systemctl restart consul nomad vault
|
consul members
|
||||||
journalctl -u nomad -f
|
|
||||||
|
# Nomad cluster
|
||||||
|
nomad server members
|
||||||
|
nomad node status
|
||||||
|
|
||||||
|
# Vault status
|
||||||
|
vault status
|
||||||
```
|
```
|
||||||
|
|
||||||
|
### Job Management
|
||||||
|
```bash
|
||||||
|
# Deploy job
|
||||||
|
nomad job run <job.hcl>
|
||||||
|
|
||||||
|
# Check job status
|
||||||
|
nomad job status <job-name>
|
||||||
|
|
||||||
|
# View allocations
|
||||||
|
nomad job allocs <job-name>
|
||||||
|
|
||||||
|
# View logs
|
||||||
|
nomad alloc logs <alloc-id> <task-name>
|
||||||
|
|
||||||
|
# Stop job
|
||||||
|
nomad job stop <job-name>
|
||||||
|
```
|
||||||
|
|
||||||
|
### Service Restarts
|
||||||
|
```bash
|
||||||
|
# On hf-pdocker-01
|
||||||
|
systemctl restart consul nomad vault
|
||||||
|
|
||||||
|
# On hf-pdocker-02
|
||||||
|
systemctl restart consul nomad
|
||||||
|
```
|
||||||
|
|
||||||
|
## IaC Repository
|
||||||
|
|
||||||
|
All job specifications are stored in Gitea:
|
||||||
|
- **Repo:** `jeremy/ansible-homelab`
|
||||||
|
- **Path:** `nomad-jobs/`
|
||||||
|
- `media-stack.nomad.hcl`
|
||||||
|
- `traefik.nomad.hcl`
|
||||||
|
|
||||||
|
## Security Notes
|
||||||
|
|
||||||
|
- Vault root token stored in `/tmp/vault-init.json` on hf-pdocker-01 (move to secure location)
|
||||||
|
- Consul encryption enabled with shared key
|
||||||
|
- mTLS not configured (internal network only)
|
||||||
|
- Cloudflare API token in Vault for Let's Encrypt DNS challenge
|
||||||
|
|
||||||
---
|
---
|
||||||
|
|
||||||
*Deployed: 2026-02-04*
|
*Last Updated: 2026-02-04*
|
||||||
*Maintained by: Pluto 🪐*
|
*Maintained by: Pluto 🪐*
|
||||||
|
|||||||
Reference in New Issue
Block a user