Enable physical server deployment

README.md

@@ -63,6 +63,17 @@ openstack-nix.nixosModules
 There are modules to setup the OpenStack controller, an OpenStack compute node
 and modules simplifying the creation of new NixOS tests.
 
+#### Designate DNS backend
+
+Enabling `designate.enable` requires a separately configured BIND server.
+The Designate module manages the OpenStack DNS services and their pool
+configuration; the deployment owns BIND, its RNDC credentials, and DNS access.
+
+The default pool expects BIND on the controller, serving DNS on port 53 and
+accepting RNDC on `127.0.0.1:953`. Provision the matching RNDC key at
+`/etc/bind/rndc.key` on the controller. Keep the key outside the Nix store;
+Designate invokes RNDC through its privileged rootwrap helper.
+
 ### NixOS tests
 
 The NixOS tests are located under the `tests` attribute. To execute a NixOS test

flake.nix

@@ -65,6 +65,7 @@
             python3Packages
             writeText
             lib
+            libredirect
             ;
         };
 

modules/compute/compute.nix

@@ -1,9 +1,19 @@
 { neutron, nova }:
-{ ... }:
+{ lib, ... }:
 {
   imports = [
+    ../generic/global-options.nix
     ../generic/controller-host-entry.nix
     (import ./neutron.nix { inherit neutron; })
     (import ./nova.nix { inherit nova; })
   ];
+
+  options.openstack.computeIP = lib.mkOption {
+    type = lib.types.str;
+    description = ''
+      IP address of the compute node, used as Nova's my_ip and as the address
+      reached by the serial-console and VNC proxies. This address must already
+      be configured on the host; this option does not configure an interface.
+    '';
+  };
 }

modules/compute/neutron.nix

@@ -3,13 +3,15 @@
   config,
   lib,
   pkgs,
+  utils,
   ...
 }:
 
 with lib;
 
 let
   cfg = config.neutron;
+  providerDevice = "${utils.escapeSystemdPath "/sys/subsystem/net/devices/${cfg.providerInterface}"}.device";
   neutron_env = pkgs.python3.buildEnv.override {
     extraLibs = [ neutron ];
   };
@@ -25,7 +27,7 @@ let
     debug = false
     # File name for the paste.deploy config for api service (string value)
     api_paste_config = ${neutron}/etc/neutron/api-paste.ini
-    transport_url = rabbit://openstack:openstack@controller
+    transport_url = rabbit://openstack:openstack@${config.openstack.controllerHostname}
     log_dir = /var/log/neutron
 
     [agent]
@@ -50,6 +52,30 @@ let
     filterPath = "/etc/neutron/rootwrap.d";
     inherit utils_env;
   };
+
+  openvswitchPrepareScript = pkgs.writeShellScript "openvswitch-setup.sh" ''
+    export PATH=${
+      lib.makeBinPath [
+        pkgs.openvswitch
+      ]
+    }:$PATH
+
+    ovs-vsctl br-exists br-provider >/dev/null
+    status=$?
+
+    if [[ $status -eq 0 ]]; then
+      echo "br-provider already exists. No further setup tasks."
+    else
+      echo "br-provider didn't exist already. Proceed with basic setup."
+      set -euxo pipefail
+      ovs-vsctl add-br br-provider
+    fi
+    ovs-vsctl --may-exist add-port br-provider ${cfg.providerInterface}
+
+    # enable uplink provider interface
+    ip link set dev ${cfg.providerInterface} up
+  '';
+
 in
 {
   options.neutron = {
@@ -68,6 +94,13 @@ in
         The Neutron OpenVSwitch config.
       '';
     };
+    openvswitchPrepare = mkOption {
+      default = openvswitchPrepareScript;
+      description = ''
+        Default OpenVswitch prepare script of systemd unit: neutron-openvswitch-agent.service
+        This prepare script creates the basic openvswitch setup.
+      '';
+    };
     providerInterface = mkOption {
       default = "eth2";
       type = types.str;
@@ -78,7 +111,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = {
     users.extraUsers.neutron = {
       group = "neutron";
       isSystemUser = true;
@@ -136,6 +169,14 @@ in
       after = [
         "network.target"
         "ovsdb.service"
+        "ovs-vswitchd.service"
+        providerDevice
+        "systemd-networkd.service"
+      ];
+      # Bridge setup needs both the switching daemon and the provider NIC.
+      requires = [
+        "ovs-vswitchd.service"
+        providerDevice
       ];
       wantedBy = [ "multi-user.target" ];
       path = with pkgs; [
@@ -150,14 +191,12 @@ in
         conntrack-tools
       ];
       serviceConfig = {
-        ExecStartPre = pkgs.writeShellScript "neutron-openvswitch-agent-pre.sh" ''
-          ${pkgs.openvswitch}/bin/ovs-vsctl add-br br-provider
-          ${pkgs.openvswitch}/bin/ovs-vsctl add-port br-provider ${cfg.providerInterface}
-        '';
+        ExecStartPre = "${cfg.openvswitchPrepare}";
         ExecStart = pkgs.writeShellScript "neutron-openvswitch-agent.sh" ''
           ${neutron}/bin/neutron-openvswitch-agent --config-file=${cfg.config} --config-file=${cfg.openvswitchConfig}
         '';
       };
+      enable = cfg.enable;
     };
   };
 }

modules/compute/nova.nix

@@ -25,8 +25,8 @@ let
     state_path = /var/lib/nova
     rootwrap_config = ${rootwrapConf}
     compute_driver = libvirt.LibvirtDriver
-    my_ip = 10.0.0.39
-    transport_url = rabbit://openstack:openstack@controller
+    my_ip = ${config.openstack.computeIP}
+    transport_url = rabbit://openstack:openstack@${config.openstack.controllerHostname}
 
     [api]
     auth_strategy = keystone
@@ -38,12 +38,12 @@ let
     connection = sqlite:////var/lib/nova/nova.sqlite
 
     [glance]
-    api_servers = http://controller:9292
+    api_servers = http://${config.openstack.controllerHostname}:9292
 
     [keystone_authtoken]
-    www_authenticate_uri = http://controller:5000/
-    auth_url = http://controller:5000/
-    memcached_servers = controller:11211
+    www_authenticate_uri = http://${config.openstack.controllerHostname}:5000/v3
+    auth_url = http://${config.openstack.controllerHostname}:5000/v3
+    memcached_servers = ${config.openstack.controllerHostname}:11211
     auth_type = password
     project_domain_name = Default
     user_domain_name = Default
@@ -53,9 +53,12 @@ let
 
     [libvirt]
     virt_type = kvm
+    ${optionalString (config.openstack.live_migration_inbound_addr != null) ''
+      live_migration_inbound_addr = ${config.openstack.live_migration_inbound_addr}
+    ''}
 
     [neutron]
-    auth_url = http://controller:5000
+    auth_url = http://${config.openstack.controllerHostname}:5000/v3
     auth_type = password
     project_domain_name = Default
     user_domain_name = Default
@@ -76,13 +79,13 @@ let
     project_name = service
     auth_type = password
     user_domain_name = Default
-    auth_url = http://controller:5000/v3
+    auth_url = http://${config.openstack.controllerHostname}:5000/v3
     username = placement
     password = placement
 
     [service_user]
     send_service_user_token = true
-    auth_url = http://controller:5000/
+    auth_url = http://${config.openstack.controllerHostname}:5000/v3
     auth_strategy = keystone
     auth_type = password
     project_domain_name = Default
@@ -146,7 +149,7 @@ in
     };
   };
 
-  config = mkIf cfg.enable {
+  config = {
     users.extraUsers.nova = {
       group = "nova";
       isSystemUser = true;
@@ -162,28 +165,28 @@ in
     systemd.tmpfiles.settings = {
       "10-nova" = {
         "/var/log/nova" = {
-          D = {
+          d = {
             group = "nova";
             mode = "0755";
             user = "nova";
           };
         };
         "/var/lock/nova" = {
-          D = {
+          d = {
             group = "nova";
             mode = "0755";
             user = "nova";
           };
         };
         "/var/lib/nova" = {
-          D = {
+          d = {
             group = "nova";
             mode = "0755";
             user = "nova";
           };
         };
         "/var/lib/nova/instances" = {
-          D = {
+          d = {
             group = "nova";
             mode = "0755";
             user = "nova";
@@ -194,7 +197,7 @@ in
     };
 
     services.openiscsi = {
-      enable = true;
+      enable = cfg.enable;
       name = "iqn.iscsi.${config.networking.hostName}";
     };
 
@@ -220,6 +223,7 @@ in
           lvm2
           openiscsi
           nfs-utils
+          e2fsprogs
         ]
         ++ cfg.extraPkgs;
       environment.PYTHONPATH = "${nova_env}/${pkgs.python3.sitePackages}";
@@ -228,6 +232,7 @@ in
           ${cfg.novaPackage}/bin/nova-compute --config-file=${cfg.config}
         '';
       };
+      enable = cfg.enable;
     };
   };
 }