Update HashiCorp stack docs with cluster info
This commit is contained in:
+118
-70
@@ -1,106 +1,154 @@
|
||||
# HashiCorp Stack - hf-pdocker-01
|
||||
# HashiCorp Stack - hobbs.farm
|
||||
|
||||
## Overview
|
||||
|
||||
Production HashiCorp stack deployed on `hf-pdocker-01` (192.168.86.192) providing orchestration, service discovery, and secrets management.
|
||||
Production HashiCorp stack providing container orchestration, service discovery, and secrets management across the hobbs.farm infrastructure.
|
||||
|
||||
## Components
|
||||
|
||||
| Service | Version | Port | UI URL |
|
||||
|---------|---------|------|--------|
|
||||
| Consul | 1.17.1 | 8500 | http://192.168.86.192:8500 |
|
||||
| Nomad | 1.7.3 | 4646 | http://192.168.86.192:4646 |
|
||||
| Vault | 1.15.4 | 8200 | http://192.168.86.192:8200 |
|
||||
|
||||
## Architecture
|
||||
## Cluster Architecture
|
||||
|
||||
```
|
||||
┌─────────────────────────────────────────────────────────┐
|
||||
│ hf-pdocker-01 (192.168.86.192) │
|
||||
├─────────────────────────────────────────────────────────┤
|
||||
│ Consul Server → Service Discovery, KV Store │
|
||||
│ Nomad Server → Workload Orchestration │
|
||||
│ Nomad Client → Runs containers │
|
||||
│ Vault Server → Secrets Management (Consul backend) │
|
||||
└─────────────────────────────────────────────────────────┘
|
||||
┌─────────────────────────────────────────────────────────────────────┐
|
||||
│ hobbs.farm Cluster │
|
||||
├────────────────────────────────┬────────────────────────────────────┤
|
||||
│ hf-pdocker-01 │ hf-pdocker-02 │
|
||||
│ 192.168.86.192 │ 192.168.86.45 │
|
||||
│ (Primary) │ (Legacy) │
|
||||
├────────────────────────────────┼────────────────────────────────────┤
|
||||
│ Consul Server (Leader) │ Consul Client │
|
||||
│ Nomad Server │ Nomad Client │
|
||||
│ Nomad Client │ node_class: legacy │
|
||||
│ Vault Server │ meta: disk_status=failing │
|
||||
└────────────────────────────────┴────────────────────────────────────┘
|
||||
```
|
||||
|
||||
## Nomad Host Volumes
|
||||
## Services
|
||||
|
||||
| Volume Name | Path | Purpose |
|
||||
|-------------|------|---------|
|
||||
| media | /data/media | Shared media files (movies, tv, downloads) |
|
||||
| Service | Version | Port | Primary URL | Notes |
|
||||
|---------|---------|------|-------------|-------|
|
||||
| Consul | 1.17.1 | 8500 | http://192.168.86.192:8500 | Service discovery, KV store |
|
||||
| Nomad | 1.7.3 | 4646 | http://192.168.86.192:4646 | Container orchestration |
|
||||
| Vault | 1.15.4 | 8200 | http://192.168.86.192:8200 | Secrets management |
|
||||
|
||||
## Deployed Jobs
|
||||
|
||||
### media-stack (service)
|
||||
| Service | Port | Health | URL |
|
||||
|---------|------|--------|-----|
|
||||
| Jellyfin | 8096 | ✅ | http://192.168.86.192:8096 |
|
||||
| Sonarr | 8989 | ✅ | http://192.168.86.192:8989 |
|
||||
| Radarr | 7878 | ✅ | http://192.168.86.192:7878 |
|
||||
| SABnzbd | 8082 | ✅ | http://192.168.86.192:8082 |
|
||||
| NZBHydra2 | 5076 | ✅ | http://192.168.86.192:5076 |
|
||||
| Jellyseerr | 5055 | ✅ | http://192.168.86.192:5055 |
|
||||
|
||||
### traefik (system)
|
||||
| Service | Port | Health | URL |
|
||||
|---------|------|--------|-----|
|
||||
| HTTP | 80 | ✅ | Redirects to HTTPS |
|
||||
| HTTPS | 443 | ✅ | Reverse proxy |
|
||||
| Dashboard | 8088 | ✅ | http://192.168.86.192:8088 |
|
||||
|
||||
## Host Volumes (hf-pdocker-01)
|
||||
|
||||
| Volume | Path | Purpose |
|
||||
|--------|------|---------|
|
||||
| media | /data/media | Movies, TV, downloads |
|
||||
| jellyfin-config | /data/configs/jellyfin | Jellyfin configuration |
|
||||
| sonarr-config | /data/configs/sonarr | Sonarr configuration |
|
||||
| radarr-config | /data/configs/radarr | Radarr configuration |
|
||||
| sabnzbd-config | /data/configs/sabnzbd | SABnzbd configuration |
|
||||
| nzbhydra-config | /data/configs/nzbhydra | NZBHydra2 configuration |
|
||||
| jellyseerr-config | /data/configs/jellyseerr | Jellyseerr configuration |
|
||||
| traefik-data | /data/traefik | Traefik certs & config |
|
||||
|
||||
## Vault Secrets Structure
|
||||
## Vault Secrets
|
||||
|
||||
```
|
||||
secret/
|
||||
└── media/
|
||||
├── jellyfin
|
||||
├── sonarr
|
||||
├── radarr
|
||||
├── sabnzbd
|
||||
├── nzbhydra
|
||||
└── jellyseerr
|
||||
```
|
||||
|
||||
## Deployed Jobs
|
||||
|
||||
### media-stack
|
||||
Combined job running all media services:
|
||||
- Jellyfin (8096) - Media streaming
|
||||
- Sonarr (8989) - TV show management
|
||||
- Radarr (7878) - Movie management
|
||||
- SABnzbd (8082) - Usenet downloader
|
||||
- NZBHydra2 (5076) - Indexer aggregator
|
||||
- Jellyseerr (5055) - Media requests
|
||||
|
||||
## Commands
|
||||
|
||||
```bash
|
||||
# Cluster status
|
||||
consul members
|
||||
nomad server members
|
||||
nomad node status
|
||||
vault status
|
||||
|
||||
# Job management
|
||||
nomad job run <job.hcl>
|
||||
nomad job status <job>
|
||||
nomad job stop <job>
|
||||
|
||||
# View logs
|
||||
nomad alloc logs <alloc-id>
|
||||
|
||||
# Vault secrets
|
||||
export VAULT_ADDR='http://127.0.0.1:8200'
|
||||
vault kv list secret/media/
|
||||
vault kv get secret/media/<service>
|
||||
├── media/
|
||||
│ ├── jellyfin
|
||||
│ ├── sonarr
|
||||
│ ├── radarr
|
||||
│ ├── sabnzbd
|
||||
│ ├── nzbhydra
|
||||
│ └── jellyseerr
|
||||
└── traefik/
|
||||
└── cloudflare (email, api_token)
|
||||
```
|
||||
|
||||
## Configuration Files
|
||||
|
||||
### hf-pdocker-01 (Server)
|
||||
| Service | Config Path |
|
||||
|---------|-------------|
|
||||
| Consul | /etc/consul.d/consul.hcl |
|
||||
| Nomad | /etc/nomad.d/nomad.hcl, client.hcl |
|
||||
| Vault | /etc/vault.d/vault.hcl |
|
||||
|
||||
## Systemd Services
|
||||
### hf-pdocker-02 (Client)
|
||||
| Service | Config Path |
|
||||
|---------|-------------|
|
||||
| Consul | /etc/consul.d/consul.hcl |
|
||||
| Nomad | /etc/nomad.d/nomad.hcl, client.hcl |
|
||||
|
||||
## Operations
|
||||
|
||||
### Check Cluster Health
|
||||
```bash
|
||||
systemctl status consul nomad vault
|
||||
systemctl restart consul nomad vault
|
||||
journalctl -u nomad -f
|
||||
# Consul cluster
|
||||
consul members
|
||||
|
||||
# Nomad cluster
|
||||
nomad server members
|
||||
nomad node status
|
||||
|
||||
# Vault status
|
||||
vault status
|
||||
```
|
||||
|
||||
### Job Management
|
||||
```bash
|
||||
# Deploy job
|
||||
nomad job run <job.hcl>
|
||||
|
||||
# Check job status
|
||||
nomad job status <job-name>
|
||||
|
||||
# View allocations
|
||||
nomad job allocs <job-name>
|
||||
|
||||
# View logs
|
||||
nomad alloc logs <alloc-id> <task-name>
|
||||
|
||||
# Stop job
|
||||
nomad job stop <job-name>
|
||||
```
|
||||
|
||||
### Service Restarts
|
||||
```bash
|
||||
# On hf-pdocker-01
|
||||
systemctl restart consul nomad vault
|
||||
|
||||
# On hf-pdocker-02
|
||||
systemctl restart consul nomad
|
||||
```
|
||||
|
||||
## IaC Repository
|
||||
|
||||
All job specifications are stored in Gitea:
|
||||
- **Repo:** `jeremy/ansible-homelab`
|
||||
- **Path:** `nomad-jobs/`
|
||||
- `media-stack.nomad.hcl`
|
||||
- `traefik.nomad.hcl`
|
||||
|
||||
## Security Notes
|
||||
|
||||
- Vault root token stored in `/tmp/vault-init.json` on hf-pdocker-01 (move to secure location)
|
||||
- Consul encryption enabled with shared key
|
||||
- mTLS not configured (internal network only)
|
||||
- Cloudflare API token in Vault for Let's Encrypt DNS challenge
|
||||
|
||||
---
|
||||
|
||||
*Deployed: 2026-02-04*
|
||||
*Last Updated: 2026-02-04*
|
||||
*Maintained by: Pluto 🪐*
|
||||
|
||||
Reference in New Issue
Block a user