[jaspermayone]

Summary

Weave stays on alastor. It is the only Patchwork app there, with Traefik. Every other app gets its own VM, so an admin of one app cannot read the secrets of another. On a shared VM, sudo and the docker group are root.

• New bare hosts, with no app yet:
  • batting (VMID 360, 10.100.90.60, 2 GB) for Quilt
  • weft (VMID 361, 10.100.90.61, 2 GB) for Krater
• Both are in flake.nix, terraform/proxmox, ad/org.json (linuxHosts, so they get lnx-<host>-users/-admins) and the docs.
• warp is now the misc host (redirects). This PR deletes hosts/warp/weave.nix (never active) and the Weave vhosts on warp.
• edge-alastor now has an empty route table, and it no longer moves Weave. alastor does not import it today.
• Docs: ad/TIERING.md, the ansible inventory comments, README.md and secrets/secrets.nix no longer plan a Weave move to warp.

flowchart LR
  alastor["alastor: Traefik + Weave"] -- ":80" --> warp["warp: misc"]
  alastor -- ":80" --> batting["batting: Quilt"]
  alastor -- ":80" --> weft["weft: Krater"]
  batting -- "tailnet :5432" --> seam
  weft -- ":5432" --> skein

Loading

Rollout

1. Merge jaspermayone/infra feat-patchwork-app-tags (the per-app tailnet tags).
2. Merge this PR. Create the VMs one at a time: tofu apply -target='proxmox_virtual_environment_vm.nixos["batting"]'. hem is not in the state either, so a plain apply also creates hem.
3. Install with nixos-anywhere. Tag each node with tag:patchwork and its app tag.
4. Add the host keys to secrets/secrets.nix (ad-join.age), then run agenix -r.
5. Next PRs: Quilt moves to batting, and feat(krater): krater staging on weft, database in patchwork_central on hem #32 (Krater) moves to weft.

Database reach and warp

• skein and the hem patchwork_central cluster are now tailnet only, as seam already was. Before, every VLAN 90 host could reach 5432 on the LAN. Now the tailnet policy picks the clients: alastor (Weave) and tag:patchwork-krater (weft). Nothing used the LAN path.
• warp has no Docker now. The docker group is root, so dom was root there. dom keeps a normal login.

Test plan

• nix build .#checks.aarch64-linux.ad-org .#checks.aarch64-linux.terraform-fmt
• nixosConfigurations.{batting,weft,warp} evaluate.
• tofu plan shows only the targeted VM.