chore: decommission vm-202-reportgen #78

Merged

admin merged 1 commits from decommission-reportgen-vm into main 2026-02-21 09:49:33 +01:00

Conversation 3 Commits 1 Files Changed 1 +1 -21

claude commented 2026-02-21 09:47:49 +01:00

Owner

Copy Link

Report-generator removed. VM 185.47.204.228 empty. Terraform will destroy:

• VM 202 (4 vCPU / 8GB RAM / 100GB)
• Proxmox FW rules
• Public IP 185.47.204.228

Atlantis will plan this automatically.

Report-generator removed. VM 185.47.204.228 empty. Terraform will destroy: - VM 202 (4 vCPU / 8GB RAM / 100GB) - Proxmox FW rules - Public IP 185.47.204.228 Atlantis will plan this automatically.

claude added 1 commit 2026-02-21 09:47:50 +01:00

chore: decommission vm-202-reportgen ... 15fdf1337a

Report-generator removed from infrastructure.
VM 185.47.204.228 no longer needed — empty PostgreSQL, no workloads.

Terraform will destroy the VM and release resources:
- 4 vCPU / 8GB RAM / 100GB disk on bare_srv_1
- Public IP 185.47.204.228

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

claude commented 2026-02-21 09:48:02 +01:00

Author

Owner

Copy Link

Ran Plan for project: production dir: environments/production workspace: default

Show Output

OpenTofu used the selected providers to generate the following execution
plan. Resource actions are indicated with the following symbols:
- destroy

OpenTofu will perform the following actions:

  # module.tenant_vm["vm-202-reportgen"].proxmox_virtual_environment_file.cloud_init will be destroyed
  # (because module.tenant_vm["vm-202-reportgen"] is not in configuration)
- resource "proxmox_virtual_environment_file" "cloud_init" {
      - content_type   = "snippets" -> null
      - datastore_id   = "local" -> null
      - file_name      = "ci-vm-202-reportgen.yaml" -> null
      - id             = "local:snippets/ci-vm-202-reportgen.yaml" -> null
      - node_name      = "georgeops" -> null
      - overwrite      = true -> null
      - timeout_upload = 1800 -> null

      - source_raw {
          - data      = (sensitive value) -> null
          - file_name = "ci-vm-202-reportgen.yaml" -> null
          - resize    = 0 -> null
        }
    }

  # module.tenant_vm["vm-202-reportgen"].proxmox_virtual_environment_firewall_options.tenant will be destroyed
  # (because module.tenant_vm["vm-202-reportgen"] is not in configuration)
- resource "proxmox_virtual_environment_firewall_options" "tenant" {
      - dhcp          = false -> null
      - enabled       = true -> null
      - id            = "options-3614604432" -> null
      - input_policy  = "DROP" -> null
      - ipfilter      = false -> null
      - log_level_in  = "nolog" -> null
      - log_level_out = "nolog" -> null
      - macfilter     = true -> null
      - ndp           = false -> null
      - node_name     = "georgeops" -> null
      - output_policy = "ACCEPT" -> null
      - radv          = true -> null
      - vm_id         = 202 -> null
    }

  # module.tenant_vm["vm-202-reportgen"].proxmox_virtual_environment_firewall_rules.tenant will be destroyed
  # (because module.tenant_vm["vm-202-reportgen"] is not in configuration)
- resource "proxmox_virtual_environment_firewall_rules" "tenant" {
      - id        = "rule-2763983303" -> null
      - node_name = "georgeops" -> null
      - vm_id     = 202 -> null

      - rule {
          - action  = "ACCEPT" -> null
          - comment = "Allow SSH" -> null
          - dport   = "22" -> null
          - enabled = true -> null
          - pos     = 0 -> null
          - proto   = "tcp" -> null
          - type    = "in" -> null
        }
      - rule {
          - action  = "ACCEPT" -> null
          - comment = "Allow ICMP" -> null
          - enabled = true -> null
          - pos     = 1 -> null
          - proto   = "icmp" -> null
          - type    = "in" -> null
        }
      - rule {
          - action  = "ACCEPT" -> null
          - comment = "Allow node_exporter from control plane" -> null
          - dport   = "9100" -> null
          - enabled = true -> null
          - pos     = 2 -> null
          - proto   = "tcp" -> null
          - source  = "78.109.17.180" -> null
          - type    = "in" -> null
        }
      - rule {
          - action  = "DROP" -> null
          - comment = "Block SMTP (anti-spam)" -> null
          - dport   = "25" -> null
          - enabled = true -> null
          - pos     = 3 -> null
          - proto   = "tcp" -> null
          - type    = "out" -> null
        }
      - rule {
          - action  = "ACCEPT" -> null
          - comment = "PostgreSQL from K8s (bare_srv_1)" -> null
          - dport   = "5432" -> null
          - enabled = true -> null
          - pos     = 4 -> null
          - proto   = "tcp" -> null
          - source  = "185.47.204.226" -> null
          - type    = "in" -> null
        }
    }

  # module.tenant_vm["vm-202-reportgen"].proxmox_virtual_environment_vm.tenant will be destroyed
  # (because module.tenant_vm["vm-202-reportgen"] is not in configuration)
- resource "proxmox_virtual_environment_vm" "tenant" {
      - acpi                                 = true -> null
      - bios                                 = "seabios" -> null
      - boot_order                           = [
          - "virtio0",
          - "net0",
        ] -> null
      - delete_unreferenced_disks_on_destroy = true -> null
      - id                                   = "202" -> null
      - ipv4_addresses                       = [] -> null
      - ipv6_addresses                       = [] -> null
      - keyboard_layout                      = "en-us" -> null
      - mac_addresses                        = [
          - "BC:24:11:24:D7:52",
        ] -> null
      - migrate                              = false -> null
      - name                                 = "vm-202-reportgen" -> null
      - network_interface_names              = [] -> null
      - node_name                            = "georgeops" -> null
      - on_boot                              = true -> null
      - protection                           = false -> null
      - purge_on_destroy                     = true -> null
      - reboot                               = false -> null
      - reboot_after_update                  = true -> null
      - scsi_hardware                        = "virtio-scsi-pci" -> null
      - started                              = true -> null
      - stop_on_destroy                      = true -> null
      - tablet_device                        = true -> null
      - tags                                 = [
          - "tenant",
          - "tofu",
          - "ubuntu",
        ] -> null
      - template                             = false -> null
      - timeout_clone                        = 1800 -> null
      - timeout_create                       = 1800 -> null
      - timeout_migrate                      = 1800 -> null
      - timeout_move_disk                    = 1800 -> null
      - timeout_reboot                       = 1800 -> null
      - timeout_shutdown_vm                  = 1800 -> null
      - timeout_start_vm                     = 1800 -> null
      - timeout_stop_vm                      = 300 -> null
      - vm_id                                = 202 -> null

      - cpu {
          - cores      = 4 -> null
          - flags      = [] -> null
          - hotplugged = 0 -> null
          - limit      = 4 -> null
          - numa       = false -> null
          - sockets    = 1 -> null
          - type       = "x86-64-v2-AES" -> null
          - units      = 0 -> null
        }

      - disk {
          - aio               = "io_uring" -> null
          - backup            = true -> null
          - cache             = "none" -> null
          - datastore_id      = "local" -> null
          - discard           = "on" -> null
          - file_format       = "qcow2" -> null
          - file_id           = "local:iso/ubuntu-24.04-cloudimg-amd64.img" -> null
          - interface         = "virtio0" -> null
          - iothread          = true -> null
          - path_in_datastore = "202/vm-202-disk-0.qcow2" -> null
          - replicate         = true -> null
          - size              = 100 -> null
          - ssd               = false -> null

          - speed {
              - iops_read            = 5000 -> null
              - iops_read_burstable  = 8000 -> null
              - iops_write           = 3000 -> null
              - iops_write_burstable = 5000 -> null
              - read                 = 200 -> null
              - read_burstable       = 400 -> null
              - write                = 100 -> null
              - write_burstable      = 200 -> null
            }
        }

      - initialization {
          - datastore_id      = "local" -> null
          - file_format       = "qcow2" -> null
          - interface         = "ide2" -> null
          - user_data_file_id = "local:snippets/ci-vm-202-reportgen.yaml" -> null

          - dns {
              - servers = [
                  - "188.93.16.19",
                  - "188.93.17.19",
                ] -> null
            }

          - ip_config {
              - ipv4 {
                  - address = "185.47.204.228/28" -> null
                  - gateway = "185.47.204.225" -> null
                }
            }
        }

      - memory {
          - dedicated      = 8192 -> null
          - floating       = 0 -> null
          - keep_hugepages = false -> null
          - shared         = 0 -> null
        }

      - network_device {
          - bridge       = "vmbr1" -> null
          - disconnected = false -> null
          - enabled      = true -> null
          - firewall     = true -> null
          - mac_address  = "BC:24:11:24:D7:52" -> null
          - model        = "virtio" -> null
          - mtu          = 0 -> null
          - queues       = 0 -> null
          - rate_limit   = 12 -> null
          - vlan_id      = 0 -> null
        }
    }

Plan: 0 to add, 0 to change, 4 to destroy.

Changes to Outputs:
~ tenant_vms    = {
      - vm-202-reportgen = {
          - public_ip = "185.47.204.228"
          - username  = "root"
          - vm_id     = 202
        }
    }

=== Checkov IaC Security Scan ===

• ▶️ To apply this plan, comment:

  atlantis apply -p production
  

• 🚮 To delete this plan and lock, click here
• 🔁 To plan this project again, comment:

  atlantis plan -p production
  

Plan: 0 to add, 0 to change, 4 to destroy.

---

• ⏩ To apply all unapplied plans from this Pull Request, comment:

  atlantis apply
  

• 🚮 To delete all plans and locks from this Pull Request, comment:

  atlantis unlock
  

Ran Plan for project: `production` dir: `environments/production` workspace: `default` <details><summary>Show Output</summary> ```diff OpenTofu used the selected providers to generate the following execution plan. Resource actions are indicated with the following symbols: - destroy OpenTofu will perform the following actions: # module.tenant_vm["vm-202-reportgen"].proxmox_virtual_environment_file.cloud_init will be destroyed # (because module.tenant_vm["vm-202-reportgen"] is not in configuration) - resource "proxmox_virtual_environment_file" "cloud_init" { - content_type = "snippets" -> null - datastore_id = "local" -> null - file_name = "ci-vm-202-reportgen.yaml" -> null - id = "local:snippets/ci-vm-202-reportgen.yaml" -> null - node_name = "georgeops" -> null - overwrite = true -> null - timeout_upload = 1800 -> null - source_raw { - data = (sensitive value) -> null - file_name = "ci-vm-202-reportgen.yaml" -> null - resize = 0 -> null } } # module.tenant_vm["vm-202-reportgen"].proxmox_virtual_environment_firewall_options.tenant will be destroyed # (because module.tenant_vm["vm-202-reportgen"] is not in configuration) - resource "proxmox_virtual_environment_firewall_options" "tenant" { - dhcp = false -> null - enabled = true -> null - id = "options-3614604432" -> null - input_policy = "DROP" -> null - ipfilter = false -> null - log_level_in = "nolog" -> null - log_level_out = "nolog" -> null - macfilter = true -> null - ndp = false -> null - node_name = "georgeops" -> null - output_policy = "ACCEPT" -> null - radv = true -> null - vm_id = 202 -> null } # module.tenant_vm["vm-202-reportgen"].proxmox_virtual_environment_firewall_rules.tenant will be destroyed # (because module.tenant_vm["vm-202-reportgen"] is not in configuration) - resource "proxmox_virtual_environment_firewall_rules" "tenant" { - id = "rule-2763983303" -> null - node_name = "georgeops" -> null - vm_id = 202 -> null - rule { - action = "ACCEPT" -> null - comment = "Allow SSH" -> null - dport = "22" -> null - enabled = true -> null - pos = 0 -> null - proto = "tcp" -> null - type = "in" -> null } - rule { - action = "ACCEPT" -> null - comment = "Allow ICMP" -> null - enabled = true -> null - pos = 1 -> null - proto = "icmp" -> null - type = "in" -> null } - rule { - action = "ACCEPT" -> null - comment = "Allow node_exporter from control plane" -> null - dport = "9100" -> null - enabled = true -> null - pos = 2 -> null - proto = "tcp" -> null - source = "78.109.17.180" -> null - type = "in" -> null } - rule { - action = "DROP" -> null - comment = "Block SMTP (anti-spam)" -> null - dport = "25" -> null - enabled = true -> null - pos = 3 -> null - proto = "tcp" -> null - type = "out" -> null } - rule { - action = "ACCEPT" -> null - comment = "PostgreSQL from K8s (bare_srv_1)" -> null - dport = "5432" -> null - enabled = true -> null - pos = 4 -> null - proto = "tcp" -> null - source = "185.47.204.226" -> null - type = "in" -> null } } # module.tenant_vm["vm-202-reportgen"].proxmox_virtual_environment_vm.tenant will be destroyed # (because module.tenant_vm["vm-202-reportgen"] is not in configuration) - resource "proxmox_virtual_environment_vm" "tenant" { - acpi = true -> null - bios = "seabios" -> null - boot_order = [ - "virtio0", - "net0", ] -> null - delete_unreferenced_disks_on_destroy = true -> null - id = "202" -> null - ipv4_addresses = [] -> null - ipv6_addresses = [] -> null - keyboard_layout = "en-us" -> null - mac_addresses = [ - "BC:24:11:24:D7:52", ] -> null - migrate = false -> null - name = "vm-202-reportgen" -> null - network_interface_names = [] -> null - node_name = "georgeops" -> null - on_boot = true -> null - protection = false -> null - purge_on_destroy = true -> null - reboot = false -> null - reboot_after_update = true -> null - scsi_hardware = "virtio-scsi-pci" -> null - started = true -> null - stop_on_destroy = true -> null - tablet_device = true -> null - tags = [ - "tenant", - "tofu", - "ubuntu", ] -> null - template = false -> null - timeout_clone = 1800 -> null - timeout_create = 1800 -> null - timeout_migrate = 1800 -> null - timeout_move_disk = 1800 -> null - timeout_reboot = 1800 -> null - timeout_shutdown_vm = 1800 -> null - timeout_start_vm = 1800 -> null - timeout_stop_vm = 300 -> null - vm_id = 202 -> null - cpu { - cores = 4 -> null - flags = [] -> null - hotplugged = 0 -> null - limit = 4 -> null - numa = false -> null - sockets = 1 -> null - type = "x86-64-v2-AES" -> null - units = 0 -> null } - disk { - aio = "io_uring" -> null - backup = true -> null - cache = "none" -> null - datastore_id = "local" -> null - discard = "on" -> null - file_format = "qcow2" -> null - file_id = "local:iso/ubuntu-24.04-cloudimg-amd64.img" -> null - interface = "virtio0" -> null - iothread = true -> null - path_in_datastore = "202/vm-202-disk-0.qcow2" -> null - replicate = true -> null - size = 100 -> null - ssd = false -> null - speed { - iops_read = 5000 -> null - iops_read_burstable = 8000 -> null - iops_write = 3000 -> null - iops_write_burstable = 5000 -> null - read = 200 -> null - read_burstable = 400 -> null - write = 100 -> null - write_burstable = 200 -> null } } - initialization { - datastore_id = "local" -> null - file_format = "qcow2" -> null - interface = "ide2" -> null - user_data_file_id = "local:snippets/ci-vm-202-reportgen.yaml" -> null - dns { - servers = [ - "188.93.16.19", - "188.93.17.19", ] -> null } - ip_config { - ipv4 { - address = "185.47.204.228/28" -> null - gateway = "185.47.204.225" -> null } } } - memory { - dedicated = 8192 -> null - floating = 0 -> null - keep_hugepages = false -> null - shared = 0 -> null } - network_device { - bridge = "vmbr1" -> null - disconnected = false -> null - enabled = true -> null - firewall = true -> null - mac_address = "BC:24:11:24:D7:52" -> null - model = "virtio" -> null - mtu = 0 -> null - queues = 0 -> null - rate_limit = 12 -> null - vlan_id = 0 -> null } } Plan: 0 to add, 0 to change, 4 to destroy. Changes to Outputs: ~ tenant_vms = { - vm-202-reportgen = { - public_ip = "185.47.204.228" - username = "root" - vm_id = 202 } } === Checkov IaC Security Scan === ``` </details> * :arrow_forward: To **apply** this plan, comment: ```shell atlantis apply -p production ``` * :put_litter_in_its_place: To **delete** this plan and lock, click [here](http://atlantis:4141/lock?id=claude%252Finfrastructure%252Fenvironments%252Fproduction%252Fdefault%252Fproduction) * :repeat: To **plan** this project again, comment: ```shell atlantis plan -p production ``` Plan: 0 to add, 0 to change, 4 to destroy. --- * :fast_forward: To **apply** all unapplied plans from this Pull Request, comment: ```shell atlantis apply ``` * :put_litter_in_its_place: To **delete** all plans and locks from this Pull Request, comment: ```shell atlantis unlock ```

claude commented 2026-02-21 09:48:04 +01:00

Author

Owner

Copy Link

AI Code Review

Reviewed. Вопросы и рекомендации:

🔴 Критические проблемы

1. Открытый пароль в истории Git

   • Пароль ir61mXhg7czPsdgf/ZHOom3j остается в Git history даже после удаления
   • Действие: Перед merge'ем выполнить git-filter-repo или BFG на ветке и принудительно обновить
   • Проверить, не скомпрометирован ли пароль (есть доступ в логах Prometheus, Loki, резервных копиях)

2. Отсутствие проверки зависимостей перед удалением

   • Не указано, что VM-202 действительно пуста
   • Рекомендация: добавить в описание результаты проверки:
     • kubectl get all --field-selector spec.nodeName=vm-202-reportgen (если K8s узел)
     • Подтверждение от owner'а сервиса
     • Скрин мониторинга (Prometheus/Grafana) за последние 7 дней

3. Нет backup перед destroy

   • Если VM восстанавливаемая → требуется снимок (сейчас в стратегии "cattle-not-pets", но проверить состояние в state/fleet/bare_srv_1/)

⚠️ Best practices

• Firewall rules: удаляются корректно (зависят от VM в коде)
• IP 185.47.204.228: вернётся в пул Selectel после destroy (уточнить в docs selectel.md, не будет ли пересобирать в другом контексте)
• Локальная переменная: правильно используется locals → module.tenant_vm for_each (проверить, что for_each корректно обрабатывает пустой map)

✅ Blast radius

• Низкий (VM изолирована, нет cross-stack зависимостей в terraform)
• Но: проверить, что ни один скрипт не hardcode'ит 185.47.204.228 (grep в ansible, k8s configs)

📋 Перед approve:

# 1. Проверить историю VM
terraform show | grep vm-202

# 2. Убедиться, что других зависимостей нет
git grep -i "vm-202\|185.47.204.228" -- . ':(exclude).git'

# 3. Переписать коммит БЕЗ пароля в сообщении, либо clean history
git filter-repo --invert-paths --path-glob '*.tf' --commit-callback 'if b"ir61mXhg7czPsdgf" in message: ...'

Итог: Approve после очистки истории Git и подтверждения отсутствия зависимостей. ✋ Не merge без fix пароля в history.

---

Automated review by Claude Haiku | advisory, does not block merge

## AI Code Review Reviewed. Вопросы и рекомендации: ## 🔴 Критические проблемы 1. **Открытый пароль в истории Git** - Пароль `ir61mXhg7czPsdgf/ZHOom3j` остается в Git history даже после удаления - **Действие:** Перед merge'ем выполнить `git-filter-repo` или `BFG` на ветке и принудительно обновить - Проверить, не скомпрометирован ли пароль (есть доступ в логах Prometheus, Loki, резервных копиях) 2. **Отсутствие проверки зависимостей перед удалением** - Не указано, что VM-202 действительно пуста - **Рекомендация:** добавить в описание результаты проверки: - `kubectl get all --field-selector spec.nodeName=vm-202-reportgen` (если K8s узел) - Подтверждение от owner'а сервиса - Скрин мониторинга (Prometheus/Grafana) за последние 7 дней 3. **Нет backup перед destroy** - Если VM восстанавливаемая → требуется снимок (сейчас в стратегии "cattle-not-pets", но проверить состояние в `state/fleet/bare_srv_1/`) ## ⚠️ Best practices - **Firewall rules:** удаляются корректно (зависят от VM в коде) - **IP 185.47.204.228:** вернётся в пул Selectel после destroy (уточнить в docs [selectel.md](selectel.md), не будет ли пересобирать в другом контексте) - **Локальная переменная:** правильно используется `locals` → `module.tenant_vm` for_each (проверить, что `for_each` корректно обрабатывает пустой map) ## ✅ Blast radius - Низкий (VM изолирована, нет cross-stack зависимостей в terraform) - **Но:** проверить, что ни один скрипт не hardcode'ит 185.47.204.228 (grep в ansible, k8s configs) ## 📋 Перед approve: ```bash # 1. Проверить историю VM terraform show | grep vm-202 # 2. Убедиться, что других зависимостей нет git grep -i "vm-202\|185.47.204.228" -- . ':(exclude).git' # 3. Переписать коммит БЕЗ пароля в сообщении, либо clean history git filter-repo --invert-paths --path-glob '*.tf' --commit-callback 'if b"ir61mXhg7czPsdgf" in message: ...' ``` **Итог:** Approve после очистки истории Git и подтверждения отсутствия зависимостей. ✋ Не merge без fix пароля в history. --- _Automated review by Claude Haiku | advisory, does not block merge_

admin merged commit 5bb9a77614 into main 2026-02-21 09:49:33 +01:00

admin deleted branch decommission-reportgen-vm 2026-02-21 09:49:33 +01:00

claude commented 2026-02-21 09:49:35 +01:00

Author

Owner

Copy Link

Locks and plans deleted for the projects and workspaces modified in this pull request:

• dir: environments/production workspace: default

Locks and plans deleted for the projects and workspaces modified in this pull request: - dir: `environments/production` workspace: `default`

admin referenced this issue from a commit 2026-02-21 09:49:35 +01:00

Merge pull request 'chore: decommission vm-202-reportgen' (#78) from decommission-reportgen-vm into main

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

admin claude

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: claude/infrastructure#78

No description provided.