9daf1fd378
- Add comprehensive database migrations (001-024) for schema evolution - Enhance API schema with expanded type definitions and resolvers - Add new middleware: audit logging, rate limiting, MFA enforcement, security, tenant auth - Implement new services: AI optimization, billing, blockchain, compliance, marketplace - Add adapter layer for cloud integrations (Cloudflare, Kubernetes, Proxmox, storage) - Update Crossplane provider with enhanced VM management capabilities - Add comprehensive test suite for API endpoints and services - Update frontend components with improved GraphQL subscriptions and real-time updates - Enhance security configurations and headers (CSP, CORS, etc.) - Update documentation and configuration files - Add new CI/CD workflows and validation scripts - Implement design system improvements and UI enhancements
337 lines
13 KiB
YAML
337 lines
13 KiB
YAML
apiVersion: proxmox.sankofa.nexus/v1alpha1
|
|
kind: ProxmoxVM
|
|
metadata:
|
|
name: phoenix-codespaces-ide
|
|
namespace: default
|
|
labels:
|
|
tenant.sankofa.nexus/id: "infrastructure"
|
|
environment: "production"
|
|
app: "phoenix"
|
|
component: "codespaces"
|
|
service: "ide"
|
|
spec:
|
|
forProvider:
|
|
node: "ml110-01"
|
|
name: "phoenix-codespaces-ide"
|
|
cpu: 8
|
|
memory: "32Gi"
|
|
disk: "200Gi"
|
|
storage: "local-lvm"
|
|
network: "vmbr0"
|
|
image: "local:iso/ubuntu-22.04-cloud.img"
|
|
site: "site-1"
|
|
userData: |
|
|
#cloud-config
|
|
# Package management
|
|
package_update: true
|
|
package_upgrade: true
|
|
|
|
# Time synchronization (NTP)
|
|
ntp:
|
|
enabled: true
|
|
ntp_client: chrony
|
|
servers:
|
|
- 0.pool.ntp.org
|
|
- 1.pool.ntp.org
|
|
- 2.pool.ntp.org
|
|
- 3.pool.ntp.org
|
|
|
|
|
|
# Required packages
|
|
packages:
|
|
- qemu-guest-agent
|
|
- curl
|
|
- wget
|
|
- net-tools
|
|
- apt-transport-https
|
|
- ca-certificates
|
|
- gnupg
|
|
- lsb-release
|
|
- chrony
|
|
- unattended-upgrades
|
|
- apt-listchanges
|
|
# IDE and development tools
|
|
- git
|
|
- docker.io
|
|
- docker-compose
|
|
- nginx
|
|
- certbot
|
|
- python3-certbot-nginx
|
|
- build-essential
|
|
- nodejs
|
|
- npm
|
|
- python3
|
|
- python3-pip
|
|
- python3-venv
|
|
- golang-go
|
|
- jq
|
|
- ufw
|
|
# AI/ML tools
|
|
- python3-dev
|
|
- python3-wheel
|
|
|
|
# User configuration
|
|
users:
|
|
- name: admin
|
|
groups: sudo, docker
|
|
shell: /bin/bash
|
|
sudo: ALL=(ALL) NOPASSWD:ALL
|
|
lock_passwd: false
|
|
ssh_authorized_keys:
|
|
- ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDbGtLMmN6px4J2QUYk0BjnNT2wytgiTLSDzL+AwhE6qQWbL+h8AeFET2CHeEf09m5KYLAbHkYTq5aUleuXsluPer9A5moPD1UfdSVLpyyIv8OvKU4mnabk4z31yenPD7Wn1hKd3WoZs2ZflFIvzXaVGBoQXFlWztWLO1fh6CXmppf731FMcTMr4x7uxd8dkG4B400a1xWFx7H4e/u33KDUApqimTrwPTfooRLuyyKV7FWpopSvbSl0ANkZsuyrjbQRR3uD66iQaI60sZArTjhjwnJz+VCOnmJhlGmfMMwov4SOemt+Ut3x0Z6CwagjvxbpGf4hoI9coYD89IFzYwXVUyB9CyvlxEyPTX3v8QwIEZtWWPDStAHTkwZ80z+LU/pvP12Su32D4Wu+ziDkONVpxh1Qh6tV+jvuA9oSKno9jLa4FO0ZTs4bPkww8AbglH3h+dV7zd7qtwwW1oeSw5GHaOq/NetfpvPVuYkOe0IxVvlODZ/d6vAjCBZ0fRgtsEuZvmCVrxwGzZEHWLeAF9G/XD+wpaA5OonceeuhF6K4H12TC3AH6ycUPIBdYOeD2askutLprLmukj8xAC5mRW4ehCnXmwjABrhLSJb7A326q6t8EO2+3u12vvMQt7xKi+aY0+wGZXSvHfiabp93OMuf3WL80A8+5NaRtby44fY6bw== defi@defi-oracle.io
|
|
|
|
# Boot commands - executed in order
|
|
runcmd:
|
|
# Verify packages are installed
|
|
- |
|
|
echo "=========================================="
|
|
echo "Verifying required packages are installed..."
|
|
echo "=========================================="
|
|
for pkg in qemu-guest-agent curl wget net-tools chrony unattended-upgrades; do
|
|
if ! dpkg -l | grep -q "^ii.*$pkg"; then
|
|
echo "ERROR: Package $pkg is not installed"
|
|
exit 1
|
|
fi
|
|
echo "✅ Package $pkg is installed"
|
|
done
|
|
echo "All required packages verified"
|
|
|
|
# Verify qemu-guest-agent package details
|
|
- |
|
|
echo "=========================================="
|
|
echo "Checking qemu-guest-agent package details..."
|
|
echo "=========================================="
|
|
if dpkg -l | grep -q "^ii.*qemu-guest-agent"; then
|
|
echo "✅ qemu-guest-agent package IS installed"
|
|
dpkg -l | grep qemu-guest-agent
|
|
else
|
|
echo "❌ qemu-guest-agent package is NOT installed"
|
|
echo "Attempting to install..."
|
|
apt-get update
|
|
apt-get install -y qemu-guest-agent
|
|
fi
|
|
|
|
# Enable and start QEMU Guest Agent
|
|
- |
|
|
echo "=========================================="
|
|
echo "Enabling and starting QEMU Guest Agent..."
|
|
echo "=========================================="
|
|
systemctl enable qemu-guest-agent
|
|
systemctl start qemu-guest-agent
|
|
echo "QEMU Guest Agent enabled and started"
|
|
|
|
# Verify guest agent service is running
|
|
- |
|
|
echo "=========================================="
|
|
echo "Verifying QEMU Guest Agent service status..."
|
|
echo "=========================================="
|
|
for i in {1..30}; do
|
|
if systemctl is-active --quiet qemu-guest-agent; then
|
|
echo "✅ QEMU Guest Agent service IS running"
|
|
systemctl status qemu-guest-agent --no-pager -l
|
|
exit 0
|
|
fi
|
|
echo "Waiting for QEMU Guest Agent to start... ($i/30)"
|
|
sleep 1
|
|
done
|
|
echo "⚠️ WARNING: QEMU Guest Agent may not have started properly"
|
|
systemctl status qemu-guest-agent --no-pager -l || true
|
|
echo "Attempting to restart..."
|
|
systemctl restart qemu-guest-agent
|
|
sleep 3
|
|
if systemctl is-active --quiet qemu-guest-agent; then
|
|
echo "✅ QEMU Guest Agent started after restart"
|
|
else
|
|
echo "❌ QEMU Guest Agent failed to start"
|
|
fi
|
|
|
|
# Configure Docker
|
|
- systemctl enable docker
|
|
- systemctl start docker
|
|
|
|
# Install code-server (VS Code in browser)
|
|
- |
|
|
echo "Installing code-server..."
|
|
curl -fsSL https://code-server.dev/install.sh | sh
|
|
systemctl enable --now code-server@admin || echo "Code-server will be configured post-deployment"
|
|
|
|
# Install Python AI/ML packages
|
|
- |
|
|
echo "Installing Python AI/ML packages..."
|
|
python3 -m pip install --upgrade pip
|
|
python3 -m pip install --user langchain openai anthropic transformers torch torchvision || echo "AI packages will be installed post-deployment"
|
|
|
|
# Create directories for code-server
|
|
- |
|
|
mkdir -p /home/admin/.config/code-server
|
|
mkdir -p /home/admin/workspaces
|
|
mkdir -p /opt/phoenix-ide
|
|
chown -R admin:admin /home/admin/.config
|
|
chown -R admin:admin /home/admin/workspaces
|
|
chown -R admin:admin /opt/phoenix-ide
|
|
|
|
# Create Phoenix-branded code-server config
|
|
- |
|
|
cat > /home/admin/.config/code-server/config.yaml <<EOF
|
|
bind-addr: 127.0.0.1:8080
|
|
auth: password
|
|
password: CHANGE_ME_ON_FIRST_LOGIN
|
|
cert: false
|
|
user-data-dir: /home/admin/.local/share/code-server
|
|
# Phoenix branding
|
|
welcome-text: "Welcome to Phoenix Codespaces IDE"
|
|
disable-telemetry: true
|
|
disable-update-check: true
|
|
EOF
|
|
chown admin:admin /home/admin/.config/code-server/config.yaml
|
|
chmod 600 /home/admin/.config/code-server/config.yaml
|
|
|
|
# Configure Nginx reverse proxy
|
|
- |
|
|
cat > /etc/nginx/sites-available/phoenix-codespaces <<EOF
|
|
server {
|
|
listen 80;
|
|
server_name codespaces.sankofa.nexus;
|
|
|
|
location / {
|
|
proxy_pass http://127.0.0.1:8080;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Upgrade \$http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
proxy_set_header Host \$host;
|
|
proxy_set_header X-Real-IP \$remote_addr;
|
|
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto \$scheme;
|
|
|
|
# WebSocket support
|
|
proxy_read_timeout 86400;
|
|
}
|
|
}
|
|
EOF
|
|
ln -sf /etc/nginx/sites-available/phoenix-codespaces /etc/nginx/sites-enabled/
|
|
rm -f /etc/nginx/sites-enabled/default
|
|
|
|
# Configure UFW firewall
|
|
- ufw allow 22/tcp # SSH
|
|
- ufw allow 80/tcp # HTTP
|
|
- ufw allow 443/tcp # HTTPS
|
|
- ufw allow 8080/tcp # Code-server (direct access, if needed)
|
|
- ufw --force enable
|
|
|
|
# Enable and start services
|
|
- systemctl enable nginx
|
|
- systemctl restart nginx
|
|
|
|
# Create AI agent service directory
|
|
- |
|
|
mkdir -p /opt/phoenix-ide/agents
|
|
mkdir -p /opt/phoenix-ide/workspaces
|
|
mkdir -p /opt/phoenix-ide/extensions
|
|
chown -R admin:admin /opt/phoenix-ide
|
|
|
|
# Install common VS Code extensions (via code-server CLI)
|
|
- |
|
|
echo "VS Code extensions will be installed post-deployment via code-server CLI"
|
|
echo "Recommended extensions:"
|
|
echo " - GitHub Copilot (or alternative)"
|
|
echo " - Python"
|
|
echo " - TypeScript"
|
|
echo " - Docker"
|
|
echo " - GitLens"
|
|
echo " - Remote Development"
|
|
|
|
# Create Phoenix AI agent helper script
|
|
- |
|
|
cat > /opt/phoenix-ide/phoenix-ai-agent.py <<'PYEOF'
|
|
#!/usr/bin/env python3
|
|
"""
|
|
Phoenix AI Agent - Copilot-like AI assistant for Phoenix Codespaces IDE
|
|
This script provides AI-powered code completion and assistance
|
|
"""
|
|
import sys
|
|
import json
|
|
|
|
def main():
|
|
print("Phoenix AI Agent - Initialized")
|
|
print("This agent will be configured post-deployment")
|
|
print("Features:")
|
|
print(" - Code completion")
|
|
print(" - Code generation")
|
|
print(" - Code review")
|
|
print(" - Automated testing")
|
|
print(" - Documentation generation")
|
|
|
|
if __name__ == "__main__":
|
|
main()
|
|
PYEOF
|
|
chmod +x /opt/phoenix-ide/phoenix-ai-agent.py
|
|
chown admin:admin /opt/phoenix-ide/phoenix-ai-agent.py
|
|
|
|
# Configure automatic security updates
|
|
- |
|
|
echo "Configuring automatic security updates..."
|
|
cat > /etc/apt/apt.conf.d/50unattended-upgrades <<'EOF'
|
|
Unattended-Upgrade::Allowed-Origins {
|
|
"${distro_id}:${distro_codename}-security";
|
|
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
|
"${distro_id}ESM:${distro_codename}-infra-security";
|
|
};
|
|
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
|
|
Unattended-Upgrade::MinimalSteps "true";
|
|
Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
|
|
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
|
Unattended-Upgrade::Automatic-Reboot "false";
|
|
Unattended-Upgrade::Automatic-Reboot-Time "02:00";
|
|
EOF
|
|
systemctl enable unattended-upgrades
|
|
systemctl start unattended-upgrades
|
|
echo "Automatic security updates configured"
|
|
|
|
# Configure NTP (Chrony)
|
|
- |
|
|
echo "Configuring NTP (Chrony)..."
|
|
systemctl enable chrony
|
|
systemctl restart chrony
|
|
sleep 3
|
|
if systemctl is-active --quiet chrony; then
|
|
echo "NTP (Chrony) is running"
|
|
chronyc tracking | head -1 || true
|
|
else
|
|
echo "WARNING: NTP (Chrony) may not be running"
|
|
fi
|
|
|
|
# SSH hardening
|
|
- |
|
|
echo "Hardening SSH configuration..."
|
|
if ! grep -q "^PermitRootLogin no" /etc/ssh/sshd_config; then
|
|
sed -i 's/^#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
|
|
sed -i 's/^PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config
|
|
fi
|
|
if ! grep -q "^PasswordAuthentication no" /etc/ssh/sshd_config; then
|
|
sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
|
|
sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
|
|
fi
|
|
if ! grep -q "^PubkeyAuthentication yes" /etc/ssh/sshd_config; then
|
|
sed -i 's/^#PubkeyAuthentication.*/PubkeyAuthentication yes/' /etc/ssh/sshd_config
|
|
fi
|
|
systemctl restart sshd
|
|
echo "SSH hardening completed
|
|
|
|
# Write files for security configuration
|
|
write_files:
|
|
- path: /etc/apt/apt.conf.d/20auto-upgrades
|
|
content: |
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Download-Upgradeable-Packages "1";
|
|
APT::Periodic::AutocleanInterval "7";
|
|
APT::Periodic::Unattended-Upgrade "1";
|
|
permissions: '0644'
|
|
owner: root:root
|
|
|
|
# Final message
|
|
final_message: |
|
|
==========================================
|
|
providerConfigRef:
|
|
name: proxmox-provider-config
|
|
|