478 lines
20 KiB
Text
478 lines
20 KiB
Text
|
use domain/workspace/mod.nu *
|
||
|
|
use platform/user/config.nu [get-workspace-path, get-active-workspace-details]
|
||
|
|
use ../../../catalog/providers/hetzner/nulib/hetzner/api.nu *
|
||
|
|
use tools/nickel/process.nu [ncl-eval-soft, default-ncl-paths]
|
||
|
|
|
||
|
|
# Export a Nickel file relative to the workspace root — always bypasses the plugin cache.
|
||
|
|
# Bootstrap modifies live cloud resources; stale config is not acceptable here.
|
||
|
|
def bootstrap-ncl-export [ws_root: string, rel_path: string]: nothing -> record {
|
||
|
|
let full_path = ($ws_root | path join $rel_path)
|
||
|
|
let import_paths = (default-ncl-paths $ws_root)
|
||
|
|
let import_args = ($import_paths | each {|p| ["--import-path" $p] } | flatten)
|
||
|
|
let r = (do { ^nickel export --format json $full_path ...$import_args } | complete)
|
||
|
|
if $r.exit_code != 0 {
|
||
|
|
error make { msg: $"NCL evaluation failed for ($full_path): ($r.stderr | str trim)" }
|
||
|
|
}
|
||
|
|
$r.stdout | from json
|
||
|
|
}
|
||
|
|
|
||
|
|
# Ensure the private network exists and all declared subnets are present.
|
||
|
|
# Creates the network if absent; reconciles subnets for existing networks.
|
||
|
|
def bootstrap-network [cfg: record]: nothing -> record {
|
||
|
|
let existing = (hetzner_api_list_networks | where name == $cfg.name)
|
||
|
|
let network = if ($existing | is-not-empty) {
|
||
|
|
print $" network ($cfg.name) already exists — skip"
|
||
|
|
($existing | first)
|
||
|
|
} else {
|
||
|
|
print $" creating network ($cfg.name) ..."
|
||
|
|
let payload = { name: $cfg.name, ip_range: $cfg.ip_range, subnets: ($cfg.subnets? | default []) }
|
||
|
|
let payload = if ("labels" in ($cfg | columns)) {
|
||
|
|
$payload | insert labels $cfg.labels
|
||
|
|
} else {
|
||
|
|
$payload
|
||
|
|
}
|
||
|
|
let created = (hetzner_api_create_network $payload)
|
||
|
|
|
||
|
|
let delete_protected = ($cfg | get -o protection.delete | default false)
|
||
|
|
if $delete_protected {
|
||
|
|
print $" enabling delete protection on ($cfg.name) ..."
|
||
|
|
let _action = (hetzner_api_network_change_protection ($created.id | into string) true)
|
||
|
|
}
|
||
|
|
$created
|
||
|
|
}
|
||
|
|
|
||
|
|
# Reconcile subnets: add any declared subnets that are missing from the network.
|
||
|
|
let declared = ($cfg.subnets? | default [])
|
||
|
|
if ($declared | is-not-empty) {
|
||
|
|
let network_detail = (hetzner_api_network_info ($network.id | into string))
|
||
|
|
let existing_ranges = ($network_detail.subnets? | default [] | each { |s| $s.ip_range })
|
||
|
|
for sn in $declared {
|
||
|
|
if not ($existing_ranges | any { |r| $r == $sn.ip_range }) {
|
||
|
|
print $" adding subnet ($sn.ip_range) to ($cfg.name) ..."
|
||
|
|
let _action = (hetzner_api_network_add_subnet ($network.id | into string) $sn)
|
||
|
|
print $" ✓ subnet ($sn.ip_range) added"
|
||
|
|
} else {
|
||
|
|
print $" subnet ($sn.ip_range) already present — skip"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
$network
|
||
|
|
}
|
||
|
|
|
||
|
|
# Ensure the SSH key exists in Hetzner Cloud, importing it if absent. Returns the ssh_key record.
|
||
|
|
def bootstrap-ssh-key [cfg: record]: nothing -> record {
|
||
|
|
let existing = (hetzner_api_list_ssh_keys | where name == $cfg.name)
|
||
|
|
if ($existing | is-not-empty) {
|
||
|
|
print $" ssh_key ($cfg.name) already exists — skip"
|
||
|
|
return ($existing | first)
|
||
|
|
}
|
||
|
|
let key_path = ($cfg.public_key_path | str replace "~" $nu.home-dir)
|
||
|
|
if (($key_path | path exists) == false) {
|
||
|
|
error make { msg: $"SSH public key not found at ($key_path)" }
|
||
|
|
}
|
||
|
|
let public_key = (open $key_path | str trim)
|
||
|
|
print $" importing ssh_key ($cfg.name) ..."
|
||
|
|
hetzner_api_create_ssh_key $cfg.name $public_key
|
||
|
|
}
|
||
|
|
|
||
|
|
# Ensure the firewall exists, creating it if absent. Returns the firewall record.
|
||
|
|
def bootstrap-firewall [cfg: record]: nothing -> record {
|
||
|
|
let existing = (hetzner_api_list_firewalls | where name == $cfg.name)
|
||
|
|
if ($existing | is-not-empty) {
|
||
|
|
print $" firewall ($cfg.name) already exists — skip"
|
||
|
|
return ($existing | first)
|
||
|
|
}
|
||
|
|
print $" creating firewall ($cfg.name) ..."
|
||
|
|
let payload = { name: $cfg.name, rules: $cfg.rules }
|
||
|
|
let payload = if ("labels" in ($cfg | columns)) {
|
||
|
|
$payload | insert labels $cfg.labels
|
||
|
|
} else {
|
||
|
|
$payload
|
||
|
|
}
|
||
|
|
hetzner_api_create_firewall $payload
|
||
|
|
}
|
||
|
|
|
||
|
|
# Ensure a Floating IP exists, creating it if absent. Returns {id, record}.
|
||
|
|
# Reconciles PTR record and server assignment for both new and existing FIPs.
|
||
|
|
def bootstrap-floating-ip [fip: record]: nothing -> record {
|
||
|
|
let existing = (hetzner_api_list_floating_ips | where name == $fip.name)
|
||
|
|
if ($existing | is-not-empty) {
|
||
|
|
let found = ($existing | first)
|
||
|
|
let fip_id = ($found.id | into string)
|
||
|
|
|
||
|
|
# Reconcile PTR
|
||
|
|
let has_ptr = ("dns_ptr" in ($fip | columns)) and (($fip.dns_ptr | is-empty) == false)
|
||
|
|
if $has_ptr {
|
||
|
|
let raw_ptr = ($found | get -o dns_ptr | default null)
|
||
|
|
let current_ptr = if $raw_ptr == null { "" } else {
|
||
|
|
let t = ($raw_ptr | describe)
|
||
|
|
if ($t | str starts-with "list") or ($t | str starts-with "table") {
|
||
|
|
$raw_ptr | first | get -o dns_ptr | default ""
|
||
|
|
} else if ($t | str starts-with "record") {
|
||
|
|
$raw_ptr | get -o dns_ptr | default ""
|
||
|
|
} else {
|
||
|
|
$raw_ptr | into string
|
||
|
|
}
|
||
|
|
}
|
||
|
|
if $current_ptr != $fip.dns_ptr {
|
||
|
|
print $" floating_ip ($fip.name) — updating PTR: '($current_ptr)' → '($fip.dns_ptr)'"
|
||
|
|
hetzner_api_floating_ip_set_rdns $fip_id $found.ip $fip.dns_ptr | ignore
|
||
|
|
} else {
|
||
|
|
print $" floating_ip ($fip.name) already exists \(id: ($fip_id)\) — PTR ok"
|
||
|
|
}
|
||
|
|
} else {
|
||
|
|
print $" floating_ip ($fip.name) already exists \(id: ($fip_id)\) — skip"
|
||
|
|
}
|
||
|
|
|
||
|
|
# Reconcile server assignment
|
||
|
|
bootstrap-floating-ip-assign $fip_id $fip $found
|
||
|
|
|
||
|
|
return { id: $fip_id, record: $found }
|
||
|
|
}
|
||
|
|
|
||
|
|
print $" creating floating_ip ($fip.name) ..."
|
||
|
|
let description = ($fip | get -o description | default "")
|
||
|
|
let labels = ($fip | get -o labels | default {})
|
||
|
|
let payload = {
|
||
|
|
type: $fip.type,
|
||
|
|
home_location: ($fip.location? | default ($fip.home_location? | default "")),
|
||
|
|
name: $fip.name,
|
||
|
|
description: $description,
|
||
|
|
labels: $labels,
|
||
|
|
}
|
||
|
|
let created = (hetzner_api_create_floating_ip $payload)
|
||
|
|
let fip_id = ($created.id | into string)
|
||
|
|
|
||
|
|
let has_ptr = ("dns_ptr" in ($fip | columns)) and (($fip.dns_ptr | is-empty) == false)
|
||
|
|
if $has_ptr {
|
||
|
|
print $" setting PTR ($fip.dns_ptr) for ($created.ip) ..."
|
||
|
|
let _action = (hetzner_api_floating_ip_set_rdns $fip_id $created.ip $fip.dns_ptr)
|
||
|
|
}
|
||
|
|
|
||
|
|
let delete_protected = ($fip | get -o protection.delete | default false)
|
||
|
|
if $delete_protected {
|
||
|
|
print $" enabling delete protection on ($fip.name) ..."
|
||
|
|
let _action = (hetzner_api_floating_ip_change_protection $fip_id true)
|
||
|
|
}
|
||
|
|
|
||
|
|
bootstrap-floating-ip-assign $fip_id $fip $created
|
||
|
|
|
||
|
|
{ id: $fip_id, record: $created }
|
||
|
|
}
|
||
|
|
|
||
|
|
# Reconcile FIP server assignment.
|
||
|
|
# Only acts on pinned FIPs (assignment.mode = 'pinned). Floating FIPs are managed manually or by HCCM.
|
||
|
|
def bootstrap-floating-ip-assign [fip_id: string, fip: record, found: record]: nothing -> nothing {
|
||
|
|
let mode = ($fip | get -o assignment.mode | default null)
|
||
|
|
if $mode != "pinned" {
|
||
|
|
if $mode == "floating" {
|
||
|
|
print $" floating_ip ($fip.name) — floating mode, skipping auto-assign"
|
||
|
|
}
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
let target = ($fip | get -o assignment.node | default "")
|
||
|
|
if ($target | is-empty) {
|
||
|
|
print $" WARNING: ($fip.name) is pinned but assignment.node is empty — skipping"
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
let servers = (hetzner_api_list_servers | where name == $target)
|
||
|
|
if ($servers | is-empty) {
|
||
|
|
print $" WARNING: pinned server '($target)' not found — skipping FIP assignment"
|
||
|
|
return
|
||
|
|
}
|
||
|
|
let server_id = ($servers | first | get id | into string)
|
||
|
|
|
||
|
|
let current_server_id = do -i { $found | get -o server.id | default null | into string } | default ""
|
||
|
|
if $current_server_id == $server_id {
|
||
|
|
print $" floating_ip ($fip.name) — already assigned to ($target)"
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
# Auto-correct: FIP is on wrong server — re-assign to pinned node
|
||
|
|
if ($current_server_id | is-not-empty) and $current_server_id != "null" {
|
||
|
|
let wrong_host = (hetzner_api_list_servers | where {|s| ($s.id | into string) == $current_server_id} | first | get -o name | default $current_server_id)
|
||
|
|
print $" ⚠ ($fip.name) currently on '($wrong_host)' — auto-correcting to pinned node '($target)'"
|
||
|
|
}
|
||
|
|
|
||
|
|
print $" floating_ip ($fip.name) — assigning to ($target) \(id: ($server_id)\) ..."
|
||
|
|
let _action = (hetzner_api_assign_floating_ip $fip_id $server_id)
|
||
|
|
print $" ✓ assigned ($fip.name) → ($target)"
|
||
|
|
}
|
||
|
|
|
||
|
|
# Persist bootstrap resource IDs to .provisioning-state.json in the workspace root.
|
||
|
|
def bootstrap-persist-state [ws_root: string, state: record]: nothing -> nothing {
|
||
|
|
let state_path = ($ws_root | path join ".provisioning-state.json")
|
||
|
|
let existing = if ($state_path | path exists) {
|
||
|
|
open --raw $state_path | from json
|
||
|
|
} else {
|
||
|
|
{}
|
||
|
|
}
|
||
|
|
($existing | merge $state) | to json --indent 2 | save --force $state_path
|
||
|
|
print $" state written to .provisioning-state.json"
|
||
|
|
}
|
||
|
|
|
||
|
|
# Provision L1 Hetzner resources: private network, SSH key, firewall, Floating IPs.
|
||
|
|
#
|
||
|
|
# Reads infra/bootstrap.ncl from the workspace root. All operations are idempotent —
|
||
|
|
# existing resources are detected via API list calls and skipped. Resource IDs are
|
||
|
|
# persisted to .provisioning-state.json for use by downstream L2 provisioning.
|
||
|
|
export def "main bootstrap" [
|
||
|
|
--workspace (-w): string # Workspace name (default: active workspace)
|
||
|
|
--dry-run (-n) # Print what would be created without calling the API
|
||
|
|
] : nothing -> nothing {
|
||
|
|
# Resolve workspace: explicit flag > PWD config/provisioning.ncl > convention > active
|
||
|
|
let ws_name = if ($workspace | is-not-empty) {
|
||
|
|
$workspace
|
||
|
|
} else {
|
||
|
|
# Priority 1: config/provisioning.ncl in PWD (workspace root detection)
|
||
|
|
let pwd_config = ($env.PWD | path join "config" "provisioning.ncl")
|
||
|
|
let from_pwd = if ($pwd_config | path exists) {
|
||
|
|
let cfg = (ncl-eval-soft $pwd_config [] null)
|
||
|
|
if $cfg != null { $cfg | get -o workspace | default "" } else { "" }
|
||
|
|
} else { "" }
|
||
|
|
|
||
|
|
if ($from_pwd | is-not-empty) {
|
||
|
|
$from_pwd
|
||
|
|
} else {
|
||
|
|
# Priority 2: convention — directory name = workspace name
|
||
|
|
let convention = ($env.PWD | path basename)
|
||
|
|
let convention_bootstrap = ($env.PWD | path join "infra" "bootstrap.ncl")
|
||
|
|
if ($convention_bootstrap | path exists) {
|
||
|
|
$convention
|
||
|
|
} else {
|
||
|
|
# Priority 3: active workspace
|
||
|
|
let details = (get-active-workspace-details)
|
||
|
|
if ($details == null) {
|
||
|
|
error make { msg: "No active workspace. Use --workspace or run from a workspace directory." }
|
||
|
|
}
|
||
|
|
$details.name
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Resolve workspace root: registered path > PWD (when inferred from PWD)
|
||
|
|
let ws_root_registered = do -i { get-workspace-path $ws_name } | default ""
|
||
|
|
let ws_root = if ($ws_root_registered | is-not-empty) {
|
||
|
|
$ws_root_registered
|
||
|
|
} else {
|
||
|
|
# If not registered, we must be in the workspace root (PWD detection above)
|
||
|
|
$env.PWD
|
||
|
|
}
|
||
|
|
let bootstrap_path = ($ws_root | path join "infra/bootstrap.ncl")
|
||
|
|
|
||
|
|
if (($bootstrap_path | path exists) == false) {
|
||
|
|
error make { msg: $"infra/bootstrap.ncl not found in workspace ($ws_name) at ($ws_root)" }
|
||
|
|
}
|
||
|
|
|
||
|
|
print $"Bootstrap L1 resources for workspace: ($ws_name)"
|
||
|
|
print $" config: ($bootstrap_path)"
|
||
|
|
|
||
|
|
let cfg = (bootstrap-ncl-export $ws_root "infra/bootstrap.ncl")
|
||
|
|
|
||
|
|
# Support both singular `network` and plural `networks` in bootstrap.ncl.
|
||
|
|
let all_networks = if ("networks" in ($cfg | columns)) {
|
||
|
|
$cfg.networks
|
||
|
|
} else {
|
||
|
|
[$cfg.network]
|
||
|
|
}
|
||
|
|
|
||
|
|
if $dry_run {
|
||
|
|
print "DRY RUN — resources that would be created:"
|
||
|
|
for net in $all_networks {
|
||
|
|
print $" network: ($net.name) \(($net.ip_range)\)"
|
||
|
|
for sn in ($net.subnets? | default []) {
|
||
|
|
print $" subnet: ($sn.ip_range) \(($sn.type), ($sn.network_zone)\)"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
print $" ssh_key: ($cfg.ssh_key.name)"
|
||
|
|
print $" firewall: ($cfg.firewall.name)"
|
||
|
|
for rule in $cfg.firewall.rules {
|
||
|
|
let port_str = if ($rule.port | is-empty) or ($rule.port == null) { "any" } else { $rule.port }
|
||
|
|
let src = ($rule.source_ips | str join ", ")
|
||
|
|
print $" ($rule.direction) ($rule.protocol)/($port_str) ← ($src)"
|
||
|
|
}
|
||
|
|
for fip in $cfg.floating_ips {
|
||
|
|
print $" floating_ip: ($fip.name) \(($fip.type), ($fip.home_location)\)"
|
||
|
|
}
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
print "\n[networks]"
|
||
|
|
let network_results = ($all_networks | each { |net| bootstrap-network $net })
|
||
|
|
# Primary network is the first one (used for state persistence)
|
||
|
|
let network = ($network_results | first)
|
||
|
|
|
||
|
|
print "\n[ssh_key]"
|
||
|
|
let ssh_key = (bootstrap-ssh-key $cfg.ssh_key)
|
||
|
|
|
||
|
|
print "\n[firewall]"
|
||
|
|
let firewall = (bootstrap-firewall $cfg.firewall)
|
||
|
|
|
||
|
|
print "\n[floating_ips]"
|
||
|
|
let fip_results = ($cfg.floating_ips | each {|fip| bootstrap-floating-ip $fip })
|
||
|
|
|
||
|
|
let fip_state = ($fip_results | reduce --fold {} {|entry, acc|
|
||
|
|
let key = ($entry.record.name | str replace --all "librecloud-fip-" "" | str replace --all "-" "_")
|
||
|
|
$acc | insert $key { id: $entry.id, ip: $entry.record.ip, name: $entry.record.name }
|
||
|
|
})
|
||
|
|
|
||
|
|
bootstrap-persist-state $ws_root {
|
||
|
|
bootstrap: {
|
||
|
|
network_id: ($network.id | into string),
|
||
|
|
network_name: $network.name,
|
||
|
|
ssh_key_id: ($ssh_key.id | into string),
|
||
|
|
firewall_id: ($firewall.id | into string),
|
||
|
|
floating_ips: $fip_state,
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Trigger reconcile so SurrealDB resource records reflect the just-bootstrapped state.
|
||
|
|
# Best-effort: silently skipped if the orchestrator daemon is not running.
|
||
|
|
let orchestrator_url = ($env.ORCHESTRATOR_URL? | default "http://localhost:8080")
|
||
|
|
do -i { http post $"($orchestrator_url)/api/v1/infra/reconcile" {workspace: $ws_name} | ignore }
|
||
|
|
|
||
|
|
print "\nBootstrap complete."
|
||
|
|
print $" network: ($network.name) id=($network.id) range=($cfg.network.ip_range)"
|
||
|
|
for sn in $cfg.network.subnets {
|
||
|
|
print $" subnet: ($sn.ip_range) \(($sn.type), ($sn.network_zone)\)"
|
||
|
|
}
|
||
|
|
print $" firewall: ($firewall.name) id=($firewall.id) rules=($cfg.firewall.rules | length)"
|
||
|
|
for fip in $fip_results {
|
||
|
|
print $" fip ($fip.record.name): id=($fip.id) ip=($fip.record.ip)"
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
# Sync firewall rules from infra/bootstrap.ncl to Hetzner — replaces all rules idempotently.
|
||
|
|
# Safe to run at any time; the set_rules API is a full replacement (not incremental).
|
||
|
|
export def "main bootstrap sync-firewall" [
|
||
|
|
--workspace (-w): string # Workspace name (default: active workspace)
|
||
|
|
--dry-run (-n) # Print rules without calling the API
|
||
|
|
]: nothing -> nothing {
|
||
|
|
let ws_name = if ($workspace | is-not-empty) {
|
||
|
|
$workspace
|
||
|
|
} else {
|
||
|
|
let pwd_config = ($env.PWD | path join "config" "provisioning.ncl")
|
||
|
|
let from_pwd = if ($pwd_config | path exists) {
|
||
|
|
let cfg = (ncl-eval-soft $pwd_config [] null)
|
||
|
|
if $cfg != null { $cfg | get -o workspace | default "" } else { "" }
|
||
|
|
} else { "" }
|
||
|
|
|
||
|
|
if ($from_pwd | is-not-empty) {
|
||
|
|
$from_pwd
|
||
|
|
} else {
|
||
|
|
let convention = ($env.PWD | path basename)
|
||
|
|
if (($env.PWD | path join "infra" "bootstrap.ncl") | path exists) {
|
||
|
|
$convention
|
||
|
|
} else {
|
||
|
|
let details = (get-active-workspace-details)
|
||
|
|
if ($details == null) {
|
||
|
|
error make { msg: "No active workspace. Use --workspace or run from a workspace directory." }
|
||
|
|
}
|
||
|
|
$details.name
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
let ws_root_registered = do -i { get-workspace-path $ws_name } | default ""
|
||
|
|
let ws_root = if ($ws_root_registered | is-not-empty) { $ws_root_registered } else { $env.PWD }
|
||
|
|
let bootstrap_path = ($ws_root | path join "infra/bootstrap.ncl")
|
||
|
|
if (($bootstrap_path | path exists) == false) {
|
||
|
|
error make { msg: $"infra/bootstrap.ncl not found in workspace ($ws_name) at ($ws_root)" }
|
||
|
|
}
|
||
|
|
|
||
|
|
let cfg = (bootstrap-ncl-export $ws_root "infra/bootstrap.ncl")
|
||
|
|
let fw_cfg = $cfg.firewall
|
||
|
|
let declared_rules = $fw_cfg.rules
|
||
|
|
|
||
|
|
let existing = (hetzner_api_list_firewalls | where name == $fw_cfg.name)
|
||
|
|
if ($existing | is-empty) {
|
||
|
|
error make { msg: $"Firewall '($fw_cfg.name)' not found — run 'prvng bootstrap' first to create it" }
|
||
|
|
}
|
||
|
|
let fw_id = ($existing | first | get id | into string)
|
||
|
|
|
||
|
|
let _fmt_rule = {|rule|
|
||
|
|
let port_str = if $rule.port == null { "any" } else { $rule.port }
|
||
|
|
let src = ($rule.source_ips | str join ", ")
|
||
|
|
$"($rule.direction) ($rule.protocol)/($port_str) ← ($src)"
|
||
|
|
}
|
||
|
|
|
||
|
|
if $dry_run {
|
||
|
|
print $"DRY RUN — rules to set on ($fw_cfg.name) \(id: ($fw_id)\):"
|
||
|
|
for rule in $declared_rules { print $" (do $_fmt_rule $rule)" }
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
print $"Syncing firewall: ($fw_cfg.name) \(id: ($fw_id)\)"
|
||
|
|
let _result = (hetzner_api_set_firewall_rules $fw_id $declared_rules)
|
||
|
|
print $" ✓ ($declared_rules | length) rules applied"
|
||
|
|
for rule in $declared_rules { print $" (do $_fmt_rule $rule)" }
|
||
|
|
}
|
||
|
|
|
||
|
|
export def "main bootstrap sync-alias-ips" [
|
||
|
|
--workspace (-w): string # Workspace name (default: active workspace)
|
||
|
|
--dry-run (-n) # Print changes without calling the API
|
||
|
|
]: nothing -> nothing {
|
||
|
|
let ws_name = if ($workspace | is-not-empty) {
|
||
|
|
$workspace
|
||
|
|
} else {
|
||
|
|
let pwd_config = ($env.PWD | path join "config" "provisioning.ncl")
|
||
|
|
let from_pwd = if ($pwd_config | path exists) {
|
||
|
|
let cfg = (ncl-eval-soft $pwd_config [] null)
|
||
|
|
if $cfg != null { $cfg | get -o workspace | default "" } else { "" }
|
||
|
|
} else { "" }
|
||
|
|
|
||
|
|
if ($from_pwd | is-not-empty) {
|
||
|
|
$from_pwd
|
||
|
|
} else {
|
||
|
|
let convention = ($env.PWD | path basename)
|
||
|
|
if (($env.PWD | path join "infra" "bootstrap.ncl") | path exists) {
|
||
|
|
$convention
|
||
|
|
} else {
|
||
|
|
let details = (get-active-workspace-details)
|
||
|
|
if ($details == null) {
|
||
|
|
error make { msg: "No active workspace. Use --workspace or run from a workspace directory." }
|
||
|
|
}
|
||
|
|
$details.name
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
let ws_root_registered = do -i { get-workspace-path $ws_name } | default ""
|
||
|
|
let ws_root = if ($ws_root_registered | is-not-empty) { $ws_root_registered } else { $env.PWD }
|
||
|
|
let bootstrap_path = ($ws_root | path join "infra/bootstrap.ncl")
|
||
|
|
if (($bootstrap_path | path exists) == false) {
|
||
|
|
error make { msg: $"infra/bootstrap.ncl not found in workspace ($ws_name) at ($ws_root)" }
|
||
|
|
}
|
||
|
|
|
||
|
|
let cfg = (bootstrap-ncl-export $ws_root "infra/bootstrap.ncl")
|
||
|
|
if not ($cfg | columns | any { $in == "alias_ips" }) {
|
||
|
|
print $"No alias_ips declared in bootstrap.ncl for workspace ($ws_name) — nothing to do."
|
||
|
|
return
|
||
|
|
}
|
||
|
|
let alias_cfg = $cfg.alias_ips
|
||
|
|
|
||
|
|
if $dry_run {
|
||
|
|
print $"DRY RUN — alias IPs to set for workspace ($ws_name):"
|
||
|
|
for entry in ($alias_cfg | transpose server ips) {
|
||
|
|
print $" ($entry.server): ($entry.ips | str join ', ')"
|
||
|
|
}
|
||
|
|
return
|
||
|
|
}
|
||
|
|
|
||
|
|
print $"Syncing alias IPs for workspace ($ws_name):"
|
||
|
|
for entry in ($alias_cfg | transpose server ips) {
|
||
|
|
let alias_list = ($entry.ips | str join ",")
|
||
|
|
print $" ($entry.server) → ($alias_list)"
|
||
|
|
let result = (do -i {
|
||
|
|
^hcloud server change-alias-ips $entry.server --network ($cfg.network.name) --alias-ips $alias_list
|
||
|
|
} | complete)
|
||
|
|
if $result.exit_code != 0 {
|
||
|
|
error make { msg: $"Failed to set alias IPs on ($entry.server): ($result.stderr | str trim)" }
|
||
|
|
}
|
||
|
|
print $" ✓ applied"
|
||
|
|
}
|
||
|
|
}
|