minio: run the real 4-node/8-drive erasure-coded cluster, not a single container
The single standalone instance from the first pass didn't match HAL's actual topology: HAL runs minio1-4, two drives each, behind an nginx load balancer on 9000 (S3) and 9001 (console). This rewrite mirrors that exactly — same node count, same erasure-coding command, same LB config — so the migration is a real like-for-like move, not a simplification. Only the two images that had to change did: the minio server (dead upstream, already fixed in the prior commit) and nginx (1.19.2-alpine is long EOL; repinned to current stable-alpine by digest). Data still lands on a fresh, empty, mesh-owned path, never HAL's live drives. The OIDC-wait entrypoint wrapper HAL used is dropped: it's a no-op when MINIO_IDENTITY_OPENID_CONFIG_URL is unset (it always is here — no OIDC integration was ever wired to minio itself), and this catalogue has no container resource field for overriding a container's entrypoint anyway — every converted module relies on the image's own entrypoint plus args, which is exactly what the original single-node version already did.
This commit is contained in:
+91
-17
@@ -19,7 +19,13 @@
|
||||
"port": 9000,
|
||||
"protocol": "tcp",
|
||||
"from": "mesh",
|
||||
"why": "the S3 endpoint"
|
||||
"why": "the S3 endpoint, load-balanced across the 4-node erasure-coded cluster"
|
||||
},
|
||||
{
|
||||
"port": 9001,
|
||||
"protocol": "tcp",
|
||||
"from": "mesh",
|
||||
"why": "the admin console, load-balanced across the 4-node erasure-coded cluster"
|
||||
}
|
||||
],
|
||||
"serves": {
|
||||
@@ -71,37 +77,105 @@
|
||||
"path": "/var/lib/minio-store",
|
||||
"mode": "0700"
|
||||
},
|
||||
{
|
||||
"id": "nginx-conf",
|
||||
"type": "file",
|
||||
"path": "/var/lib/minio/nginx.conf",
|
||||
"mode": "0644",
|
||||
"content": "user nginx;\nworker_processes auto;\n\nerror_log /var/log/nginx/error.log warn;\npid /var/run/nginx.pid;\n\nevents {\n worker_connections 4096;\n}\n\nhttp {\n include /etc/nginx/mime.types;\n default_type application/octet-stream;\n\n log_format main '$remote_addr - $remote_user [$time_local] \"$request\" '\n '$status $body_bytes_sent \"$http_referer\" '\n '\"$http_user_agent\" \"$http_x_forwarded_for\"';\n\n access_log /var/log/nginx/access.log main;\n sendfile on;\n keepalive_timeout 65;\n\n upstream minio {\n server minio1:9000;\n server minio2:9000;\n server minio3:9000;\n server minio4:9000;\n }\n\n upstream console {\n ip_hash;\n server minio1:9001;\n server minio2:9001;\n server minio3:9001;\n server minio4:9001;\n }\n\n server {\n listen 9000;\n listen [::]:9000;\n server_name localhost;\n\n ignore_invalid_headers off;\n client_max_body_size 0;\n proxy_buffering off;\n\n location / {\n proxy_set_header Host $http_host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Forwarded-Proto $scheme;\n\n proxy_connect_timeout 300;\n proxy_http_version 1.1;\n proxy_set_header Connection \"\";\n chunked_transfer_encoding off;\n\n proxy_pass http://minio;\n }\n }\n\n server {\n listen 9001;\n listen [::]:9001;\n server_name localhost;\n\n ignore_invalid_headers off;\n client_max_body_size 0;\n proxy_buffering off;\n\n location / {\n proxy_set_header Host $http_host;\n proxy_set_header X-Real-IP $remote_addr;\n proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;\n proxy_set_header X-Forwarded-Proto $scheme;\n proxy_set_header X-NginX-Proxy true;\n\n real_ip_header X-Real-IP;\n\n proxy_connect_timeout 300;\n proxy_http_version 1.1;\n proxy_set_header Upgrade $http_upgrade;\n proxy_set_header Connection \"upgrade\";\n\n chunked_transfer_encoding off;\n\n proxy_pass http://console;\n }\n }\n}\n"
|
||||
},
|
||||
{
|
||||
"id": "net",
|
||||
"type": "network",
|
||||
"name": "minio"
|
||||
},
|
||||
{
|
||||
"id": "server",
|
||||
"id": "minio1",
|
||||
"type": "container",
|
||||
"name": "minio",
|
||||
"name": "minio1",
|
||||
"image": "docker.io/pgsty/minio@sha256:b6bfe7239bfc83fb90d31612d9704d86039dd714f7904b3f1ad68f211e602372",
|
||||
"network": "minio",
|
||||
"args": [
|
||||
"server",
|
||||
"/data",
|
||||
"--console-address",
|
||||
":9001"
|
||||
],
|
||||
"env-file": [
|
||||
"/var/lib/minio/root.env"
|
||||
],
|
||||
"ports": [
|
||||
"9000"
|
||||
],
|
||||
"args": ["server", "--console-address", ":9001", "http://minio{1...4}/data{1...2}"],
|
||||
"env-file": ["/var/lib/minio/root.env"],
|
||||
"volumes": [
|
||||
"/var/lib/minio-store:/data",
|
||||
"/var/lib/minio-store/data1-1:/data1",
|
||||
"/var/lib/minio-store/data1-2:/data2",
|
||||
"/var/lib/minio-store/unused-volume-stub/minio1:/data",
|
||||
"/var/lib/minio/root.secret:/run/secrets/root:ro"
|
||||
],
|
||||
"env": {
|
||||
"MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root"
|
||||
"MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
|
||||
"MINIO_BROWSER_REDIRECT_URL": "https://files.novox.be"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "minio2",
|
||||
"type": "container",
|
||||
"name": "minio2",
|
||||
"image": "docker.io/pgsty/minio@sha256:b6bfe7239bfc83fb90d31612d9704d86039dd714f7904b3f1ad68f211e602372",
|
||||
"network": "minio",
|
||||
"args": ["server", "--console-address", ":9001", "http://minio{1...4}/data{1...2}"],
|
||||
"env-file": ["/var/lib/minio/root.env"],
|
||||
"volumes": [
|
||||
"/var/lib/minio-store/data2-1:/data1",
|
||||
"/var/lib/minio-store/data2-2:/data2",
|
||||
"/var/lib/minio-store/unused-volume-stub/minio2:/data",
|
||||
"/var/lib/minio/root.secret:/run/secrets/root:ro"
|
||||
],
|
||||
"env": {
|
||||
"MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
|
||||
"MINIO_BROWSER_REDIRECT_URL": "https://files.novox.be"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "minio3",
|
||||
"type": "container",
|
||||
"name": "minio3",
|
||||
"image": "docker.io/pgsty/minio@sha256:b6bfe7239bfc83fb90d31612d9704d86039dd714f7904b3f1ad68f211e602372",
|
||||
"network": "minio",
|
||||
"args": ["server", "--console-address", ":9001", "http://minio{1...4}/data{1...2}"],
|
||||
"env-file": ["/var/lib/minio/root.env"],
|
||||
"volumes": [
|
||||
"/var/lib/minio-store/data3-1:/data1",
|
||||
"/var/lib/minio-store/data3-2:/data2",
|
||||
"/var/lib/minio-store/unused-volume-stub/minio3:/data",
|
||||
"/var/lib/minio/root.secret:/run/secrets/root:ro"
|
||||
],
|
||||
"env": {
|
||||
"MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
|
||||
"MINIO_BROWSER_REDIRECT_URL": "https://files.novox.be"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "minio4",
|
||||
"type": "container",
|
||||
"name": "minio4",
|
||||
"image": "docker.io/pgsty/minio@sha256:b6bfe7239bfc83fb90d31612d9704d86039dd714f7904b3f1ad68f211e602372",
|
||||
"network": "minio",
|
||||
"args": ["server", "--console-address", ":9001", "http://minio{1...4}/data{1...2}"],
|
||||
"env-file": ["/var/lib/minio/root.env"],
|
||||
"volumes": [
|
||||
"/var/lib/minio-store/data4-1:/data1",
|
||||
"/var/lib/minio-store/data4-2:/data2",
|
||||
"/var/lib/minio-store/unused-volume-stub/minio4:/data",
|
||||
"/var/lib/minio/root.secret:/run/secrets/root:ro"
|
||||
],
|
||||
"env": {
|
||||
"MINIO_ROOT_PASSWORD_FILE": "/run/secrets/root",
|
||||
"MINIO_BROWSER_REDIRECT_URL": "https://files.novox.be"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "lb",
|
||||
"type": "container",
|
||||
"name": "minio",
|
||||
"image": "docker.io/library/nginx@sha256:985220252f3863977e468f611ef118ebd01421289dd86ee1ae99cb068c3bce2b",
|
||||
"network": "minio",
|
||||
"ports": ["9000", "9001"],
|
||||
"volumes": [
|
||||
"/var/lib/minio/nginx.conf:/etc/nginx/nginx.conf:ro"
|
||||
]
|
||||
},
|
||||
{
|
||||
"id": "runtime",
|
||||
"type": "container",
|
||||
|
||||
Reference in New Issue
Block a user