dummy us and uk k8s_token markers [DO-NOT-MERGE]

Signed-off-by: Alejandro Mery <amery@jpi.io>

.gitignore

@@ -1 +1,2 @@
 .tmp
+.version

cloud.yaml

@@ -0,0 +1,159 @@
+dir: m
+name: m
+domain: jpi.cloud
+ceph_fsid: 28180b9b-6d5d-4be0-bb5b-e4b04bf03804
+regions:
+  - name: eu
+    cluster: K102eb227eec765a3389ba82944c0c78ab1f14f3b4383831f47416598e54d64abbb::server:567b2023506e45f7ec0009a991824f1c
+    regions:
+      - de
+      - nl
+  - name: uk
+    cluster: ""
+  - name: us
+    cluster: ""
+  - name: earth
+    regions:
+      - europe
+      - us
+  - name: europe
+    regions:
+      - eu
+      - uk
+zones:
+  - id: 1
+    name: ssd-lon
+    regions:
+      - uk
+    machines:
+      - id: 3
+        public:
+          - 63.250.53.5
+          - 2602:ff16:7:0:1:66:0:1
+        rings:
+          - ring: 0
+            enabled: true
+            keys:
+              privatekey: WJY1yrd14c0gY4qqq1O8BPck46TVYebXrT+OoMbEqG8=
+              publickey: aDXNwapVjufcuQKfBN+waJObe1TaeeaSNl1suA0u+00=
+          - ring: 1
+            enabled: true
+            keys:
+              privatekey: 2CDO+x8HVKfw1/iqC2WkwIEQyWZsC9XPW1otqxarR0o=
+              publickey: untmMfW2W4OiMgG/6nAysoivXtDh7cZ9/rxhgJ4OlC4=
+      - id: 4
+        ceph_monitor: true
+        public:
+          - 63.250.53.164
+          - 2602:ff16:7:0:1:50:0:1
+        rings:
+          - ring: 1
+            enabled: true
+            keys:
+              privatekey: wE05rSTPSlX9CUdyglpRsNqMVdh8bZSvmUlalGXArEE=
+              publickey: f7AcZy4H2qfi7BRtRA82VdJAqc+IXU90k88GKBp9piM=
+      - id: 5
+        public:
+          - 63.250.53.135
+          - 2602:ff16:7:0:1:156:0:1
+        rings:
+          - ring: 1
+            enabled: true
+            keys:
+              privatekey: oMLrZ8ZmNeWrVroGTh9lx9cJC1enWCF5VfIkv8t+jmk=
+              publickey: 9cUNKM8TPbD8BRjV7TG9/BuTq+2JO8KyrPCx69KW+Bk=
+      - id: 7
+        public:
+          - 107.155.122.3
+          - 2602:ff16:7:0:1:6d:0:1
+        rings:
+          - ring: 1
+            enabled: true
+            keys:
+              privatekey: iN4Rc3J36APlkIP/ksSpHIwAuxC/ehYLwGQ5va1AhG8=
+              publickey: XGVXDmxQajHpsgpzgrp+r/ZWxZUaodTpvGBJuLlZ0n4=
+  - id: 2
+    name: ssd-ams
+    regions:
+      - nl
+    machines:
+      - id: 3
+        public:
+          - 89.233.107.128
+          - 2602:ff16:9:0:1:1a7:0:1
+        rings:
+          - ring: 0
+            enabled: true
+            keys:
+              privatekey: oHVQY976pFH1lAhCrz9c40vR/e5PIXw7ZXv6pU6A5Ho=
+              publickey: y/Gkid2Mjxo1WO9Zi7mh+DETNYKT/AAc3K3bvr9xp3c=
+          - ring: 1
+            enabled: true
+            keys:
+              privatekey: 6I/ZMxaWUTbNc+SIGkNKxgovONqv6EAvg7NeeTRrR1c=
+              publickey: 9i0XI358OOYYoxoxV5lX8siqE8uiEwCsuWLo6LoFu0Y=
+      - id: 4
+        ceph_monitor: true
+        public:
+          - 89.233.107.251
+          - 2602:ff16:9:0:1:130:0:1
+        rings:
+          - ring: 1
+            enabled: true
+            keys:
+              privatekey: SPBd5Ka29ZecKYy7BW85rW7FO9dwKwoUHlSibybPG1s=
+              publickey: QpJupYlnJc7wc3+gAlEmbFMonsqpVnYRy7f/gnPqqBw=
+      - id: 5
+        inactive: true
+        public:
+          - 89.233.107.107
+          - 2602:ff16:9:0:1:74:0:1
+        rings:
+          - ring: 1
+            enabled: true
+            keys:
+              privatekey: mJaFvu9TBwE2i0rjhfhvpB3xZmp++3BVwa7QAvWXImY=
+              publickey: HDLVEwLv0uugyZ9C1C9ZWuiaWQ1qIqqe/DAUxYI0whM=
+  - id: 3
+    name: htz-fsn
+    regions:
+      - de
+    machines:
+      - id: 1
+        ceph_monitor: true
+        public:
+          - 157.90.209.125
+          - 2a01:4f8:252:168f::2
+        rings:
+          - ring: 0
+            enabled: true
+            keys:
+              privatekey: AMz/pCgOMVh1/2rT9uCFMox+LQgH5FrE4xUeqSs0x0M=
+              publickey: K9LYog8vtRFN4nW6dJWMQ9trmRrYuLpbu/Ze5kIiBGw=
+          - ring: 1
+            enabled: true
+            keys:
+              privatekey: 2JpA1G0Dp+sEuDhKnzToz0h76o2iLP+S7Qb9itlgXVA=
+              publickey: qWmYfgeRAQ563gWLdeYs65XjGJTSE+W8WTbpLZ0e1CQ=
+  - id: 4
+    name: ssd-nyc
+    regions:
+      - us
+    machines:
+      - id: 3
+        inactive: true
+        ceph_monitor: true
+        public:
+          - 208.87.134.41
+          - 2602:ff16:3:0:1:4fa:0:1
+        rings:
+          - ring: 0
+            enabled: true
+            keys:
+              privatekey: YNDxj+QSO3p5pXw9h7lBx0cLM0kJDv3v7BYLfc8TR3I=
+              publickey: 1UFgleUufTszPM1voIcwVhd0DpYZ1HwV05U6p3IS2DE=
+          - ring: 1
+            enabled: true
+            keys:
+              privatekey: APXGKqOxx1gOr587FSN3O3gRGpkGgSjt6zGlTu49UlU=
+              publickey: av8ni/9ZUyozabzqTjIy1sOnSJuQ9p63Tu9ECVmHB2I=

cmd/jpictl/main.go

@@ -2,6 +2,8 @@
 package main
 
 import (
+	_ "embed"
+
 	"github.com/spf13/cobra"
 )
 
@@ -12,8 +14,9 @@ const (
 
 var (
 	rootCmd = &cobra.Command{
-		Use:   CmdName,
+		Use:     CmdName,
-		Short: "control tool for jpi.cloud",
+		Short:   "control tool for jpi.cloud",
+		Version: version,
 	}
 )
 

cmd/jpictl/version.go

@@ -0,0 +1,31 @@
+package main
+
+import (
+	_ "embed"
+
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+)
+
+//go:generate sh -c "git describe | tr -d '\r\n' > .version"
+//go:embed .version
+var version string
+
+var versionCmd = &cobra.Command{
+	Use:   "version",
+	Short: "Returns jpictl's version",
+	Args:  cobra.NoArgs,
+	Run: func(_ *cobra.Command, _ []string) {
+		_, _ = fmt.Fprintf(os.Stdout, "%s\n", version)
+	},
+}
+
+func init() {
+	if version == "" {
+		version = "undetermined"
+	}
+
+	rootCmd.AddCommand(versionCmd)
+}

go.mod

@@ -2,8 +2,6 @@ module git.jpi.io/amery/jpictl
 
 go 1.19
 
-replace asciigoat.org/ini => ../../../asciigoat.org/ini
-
 require (
 	asciigoat.org/ini v0.2.5
 	darvaza.org/core v0.12.0

go.sum

@@ -1,5 +1,7 @@
 asciigoat.org/core v0.3.9 h1:hgDDz4ecm3ZvehX++m8A/IzAt+B5oDPiRtxatzfUHPQ=
 asciigoat.org/core v0.3.9/go.mod h1:CAaHwyw8MpAq4a1MYtN2dxJrsK+hmIdW50OndaQZYPI=
+asciigoat.org/ini v0.2.5 h1:4gRIp9rU+XQt8+HMqZO5R7GavMv9Yl2+N+je6djDIAE=
+asciigoat.org/ini v0.2.5/go.mod h1:gmXzJ9XFqf1NLk5nQkj04USQ4tMtdRJHNQX6vp3DzjU=
 darvaza.org/cache/x/simplelru v0.1.8 h1:rvFucut4wKYbsYc994yR3P0M08NqlsvZxr5G4QK82tw=
 darvaza.org/cache/x/simplelru v0.1.8/go.mod h1:Mv1isOJTcXYK+aK0AvUe+/3KpRTXDsYga6rdTS/upNs=
 darvaza.org/core v0.12.0 h1:LLtYh9RZJSd0sgPTDocofCc4H5jbutSUQgPbKt+8gcI=

m/ceph.conf

@@ -0,0 +1,5 @@
+[global]
+fsid = 28180b9b-6d5d-4be0-bb5b-e4b04bf03804
+mon_initial_members = ssd-lon-4, ssd-ams-4, htz-fsn-1, ssd-nyc-3
+mon_host = 10.16.0.4, 10.32.0.4, 10.48.0.1, 10.64.0.3
+cluster_network = 10.0.0.0/8

m/earth/regions

@@ -0,0 +1,2 @@
+europe
+us

m/eu/k8s_token

@@ -0,0 +1 @@
+K102eb227eec765a3389ba82944c0c78ab1f14f3b4383831f47416598e54d64abbb::server:567b2023506e45f7ec0009a991824f1c

m/eu/regions

@@ -0,0 +1,2 @@
+de
+nl

m/europe/regions

@@ -0,0 +1,2 @@
+eu
+uk

m/htz-fsn/htz-fsn-1/hosts

@@ -0,0 +1,24 @@
+127.0.0.1 localhost
+
+# The following lines are desirable for IPv6 capable hosts
+::1     ip6-localhost ip6-loopback
+fe00::0 ip6-localnet
+ff00::0 ip6-mcastprefix
+ff02::1 ip6-allnodes
+ff02::2 ip6-allrouters
+ff02::3 ip6-allhosts
+
+10.16.0.3  ssd-lon-3
+10.16.0.4  ssd-lon-4 ssd-lon-ceph ssd-lon-k3s
+10.16.0.5  ssd-lon-5
+10.16.0.7  ssd-lon-7
+10.32.0.3  ssd-ams-3
+10.32.0.4  ssd-ams-4 ssd-ams-ceph ssd-ams-k3s
+10.32.0.5  ssd-ams-5
+10.48.0.1  htz-fsn-1 htz-fsn-ceph htz-fsn-k3s ceph k3s
+10.64.0.3  ssd-nyc-3 ssd-nyc-ceph ssd-nyc-k3s
+
+10.0.1.3  ssd-lon-3-0
+10.0.2.3  ssd-ams-3-0
+10.0.3.1  htz-fsn-1-0
+10.0.4.3  ssd-nyc-3-0

m/htz-fsn/htz-fsn-1/wg0.conf

@@ -0,0 +1,23 @@
+[Interface]
+# Name: htz-fsn-1-0
+Address = 10.0.3.1
+PrivateKey = AMz/pCgOMVh1/2rT9uCFMox+LQgH5FrE4xUeqSs0x0M=
+ListenPort = 51800
+
+[Peer]
+# Name: ssd-lon-3-0
+PublicKey = aDXNwapVjufcuQKfBN+waJObe1TaeeaSNl1suA0u+00=
+Endpoint = ssd-lon-3.m.jpi.cloud:51800
+AllowedIPs = 10.16.0.0/12, 10.0.1.3/32
+
+[Peer]
+# Name: ssd-ams-3-0
+PublicKey = y/Gkid2Mjxo1WO9Zi7mh+DETNYKT/AAc3K3bvr9xp3c=
+Endpoint = ssd-ams-3.m.jpi.cloud:51800
+AllowedIPs = 10.32.0.0/12, 10.0.2.3/32
+
+[Peer]
+# Name: ssd-nyc-3-0
+PublicKey = 1UFgleUufTszPM1voIcwVhd0DpYZ1HwV05U6p3IS2DE=
+Endpoint = ssd-nyc-3.m.jpi.cloud:51800
+AllowedIPs = 10.64.0.0/12, 10.0.4.3/32

m/htz-fsn/htz-fsn-1/wg0.key

@@ -0,0 +1 @@
+AMz/pCgOMVh1/2rT9uCFMox+LQgH5FrE4xUeqSs0x0M=

m/htz-fsn/htz-fsn-1/wg0.pub

@@ -0,0 +1 @@
+K9LYog8vtRFN4nW6dJWMQ9trmRrYuLpbu/Ze5kIiBGw=

m/htz-fsn/htz-fsn-1/wg1.conf

@@ -0,0 +1,5 @@
+[Interface]
+# Name: htz-fsn-1-1
+Address = 10.48.0.1
+PrivateKey = 2JpA1G0Dp+sEuDhKnzToz0h76o2iLP+S7Qb9itlgXVA=
+ListenPort = 51810

m/htz-fsn/htz-fsn-1/wg1.key

@@ -0,0 +1 @@
+2JpA1G0Dp+sEuDhKnzToz0h76o2iLP+S7Qb9itlgXVA=

m/htz-fsn/htz-fsn-1/wg1.pub

@@ -0,0 +1 @@
+qWmYfgeRAQ563gWLdeYs65XjGJTSE+W8WTbpLZ0e1CQ=

m/htz-fsn/regions

@@ -0,0 +1 @@
+de

m/ssd-ams/regions

@@ -0,0 +1 @@
+nl

m/ssd-ams/ssd-ams-3/hosts

@@ -0,0 +1,24 @@
+127.0.0.1 localhost
+
+# The following lines are desirable for IPv6 capable hosts
+::1     ip6-localhost ip6-loopback
+fe00::0 ip6-localnet
+ff00::0 ip6-mcastprefix
+ff02::1 ip6-allnodes
+ff02::2 ip6-allrouters
+ff02::3 ip6-allhosts
+
+10.16.0.3  ssd-lon-3
+10.16.0.4  ssd-lon-4 ssd-lon-ceph ssd-lon-k3s
+10.16.0.5  ssd-lon-5
+10.16.0.7  ssd-lon-7
+10.32.0.3  ssd-ams-3
+10.32.0.4  ssd-ams-4 ssd-ams-ceph ssd-ams-k3s ceph k3s
+10.32.0.5  ssd-ams-5
+10.48.0.1  htz-fsn-1 htz-fsn-ceph htz-fsn-k3s
+10.64.0.3  ssd-nyc-3 ssd-nyc-ceph ssd-nyc-k3s
+
+10.0.1.3  ssd-lon-3-0
+10.0.2.3  ssd-ams-3-0
+10.0.3.1  htz-fsn-1-0
+10.0.4.3  ssd-nyc-3-0

m/ssd-ams/ssd-ams-3/wg0.conf

@@ -0,0 +1,23 @@
+[Interface]
+# Name: ssd-ams-3-0
+Address = 10.0.2.3
+PrivateKey = oHVQY976pFH1lAhCrz9c40vR/e5PIXw7ZXv6pU6A5Ho=
+ListenPort = 51800
+
+[Peer]
+# Name: ssd-lon-3-0
+PublicKey = aDXNwapVjufcuQKfBN+waJObe1TaeeaSNl1suA0u+00=
+Endpoint = ssd-lon-3.m.jpi.cloud:51800
+AllowedIPs = 10.16.0.0/12, 10.0.1.3/32
+
+[Peer]
+# Name: htz-fsn-1-0
+PublicKey = K9LYog8vtRFN4nW6dJWMQ9trmRrYuLpbu/Ze5kIiBGw=
+Endpoint = htz-fsn-1.m.jpi.cloud:51800
+AllowedIPs = 10.48.0.0/12, 10.0.3.1/32
+
+[Peer]
+# Name: ssd-nyc-3-0
+PublicKey = 1UFgleUufTszPM1voIcwVhd0DpYZ1HwV05U6p3IS2DE=
+Endpoint = ssd-nyc-3.m.jpi.cloud:51800
+AllowedIPs = 10.64.0.0/12, 10.0.4.3/32

m/ssd-ams/ssd-ams-3/wg0.key

@@ -0,0 +1 @@
+oHVQY976pFH1lAhCrz9c40vR/e5PIXw7ZXv6pU6A5Ho=

m/ssd-ams/ssd-ams-3/wg0.pub

@@ -0,0 +1 @@
+y/Gkid2Mjxo1WO9Zi7mh+DETNYKT/AAc3K3bvr9xp3c=

m/ssd-ams/ssd-ams-3/wg1.conf

@@ -0,0 +1,17 @@
+[Interface]
+# Name: ssd-ams-3-1
+Address = 10.32.0.3
+PrivateKey = 6I/ZMxaWUTbNc+SIGkNKxgovONqv6EAvg7NeeTRrR1c=
+ListenPort = 51810
+
+[Peer]
+# Name: ssd-ams-4-1
+PublicKey = QpJupYlnJc7wc3+gAlEmbFMonsqpVnYRy7f/gnPqqBw=
+Endpoint = ssd-ams-4.m.jpi.cloud:51810
+AllowedIPs = 10.32.0.4/32
+
+[Peer]
+# Name: ssd-ams-5-1
+PublicKey = HDLVEwLv0uugyZ9C1C9ZWuiaWQ1qIqqe/DAUxYI0whM=
+Endpoint = ssd-ams-5.m.jpi.cloud:51810
+AllowedIPs = 10.32.0.5/32

m/ssd-ams/ssd-ams-3/wg1.key

@@ -0,0 +1 @@
+6I/ZMxaWUTbNc+SIGkNKxgovONqv6EAvg7NeeTRrR1c=

m/ssd-ams/ssd-ams-3/wg1.pub

@@ -0,0 +1 @@
+9i0XI358OOYYoxoxV5lX8siqE8uiEwCsuWLo6LoFu0Y=

m/ssd-ams/ssd-ams-4/hosts

@@ -0,0 +1,24 @@
+127.0.0.1 localhost
+
+# The following lines are desirable for IPv6 capable hosts
+::1     ip6-localhost ip6-loopback
+fe00::0 ip6-localnet
+ff00::0 ip6-mcastprefix
+ff02::1 ip6-allnodes
+ff02::2 ip6-allrouters
+ff02::3 ip6-allhosts
+
+10.16.0.3  ssd-lon-3
+10.16.0.4  ssd-lon-4 ssd-lon-ceph ssd-lon-k3s
+10.16.0.5  ssd-lon-5
+10.16.0.7  ssd-lon-7
+10.32.0.3  ssd-ams-3
+10.32.0.4  ssd-ams-4 ssd-ams-ceph ssd-ams-k3s ceph k3s
+10.32.0.5  ssd-ams-5
+10.48.0.1  htz-fsn-1 htz-fsn-ceph htz-fsn-k3s
+10.64.0.3  ssd-nyc-3 ssd-nyc-ceph ssd-nyc-k3s
+
+10.0.1.3  ssd-lon-3-0
+10.0.2.3  ssd-ams-3-0
+10.0.3.1  htz-fsn-1-0
+10.0.4.3  ssd-nyc-3-0

m/ssd-ams/ssd-ams-4/wg1.conf

@@ -0,0 +1,17 @@
+[Interface]
+# Name: ssd-ams-4-1
+Address = 10.32.0.4
+PrivateKey = SPBd5Ka29ZecKYy7BW85rW7FO9dwKwoUHlSibybPG1s=
+ListenPort = 51810
+
+[Peer]
+# Name: ssd-ams-3-1
+PublicKey = 9i0XI358OOYYoxoxV5lX8siqE8uiEwCsuWLo6LoFu0Y=
+Endpoint = ssd-ams-3.m.jpi.cloud:51810
+AllowedIPs = 10.32.0.3/32, 10.16.0.0/12, 10.48.0.0/12, 10.64.0.0/12, 10.0.1.3/32, 10.0.2.3/32, 10.0.3.1/32, 10.0.4.3/32
+
+[Peer]
+# Name: ssd-ams-5-1
+PublicKey = HDLVEwLv0uugyZ9C1C9ZWuiaWQ1qIqqe/DAUxYI0whM=
+Endpoint = ssd-ams-5.m.jpi.cloud:51810
+AllowedIPs = 10.32.0.5/32

m/ssd-ams/ssd-ams-4/wg1.key

@@ -0,0 +1 @@
+SPBd5Ka29ZecKYy7BW85rW7FO9dwKwoUHlSibybPG1s=

m/ssd-ams/ssd-ams-4/wg1.pub

@@ -0,0 +1 @@
+QpJupYlnJc7wc3+gAlEmbFMonsqpVnYRy7f/gnPqqBw=

m/ssd-ams/ssd-ams-5/hosts

@@ -0,0 +1,24 @@
+127.0.0.1 localhost
+
+# The following lines are desirable for IPv6 capable hosts
+::1     ip6-localhost ip6-loopback
+fe00::0 ip6-localnet
+ff00::0 ip6-mcastprefix
+ff02::1 ip6-allnodes
+ff02::2 ip6-allrouters
+ff02::3 ip6-allhosts
+
+10.16.0.3  ssd-lon-3
+10.16.0.4  ssd-lon-4 ssd-lon-ceph ssd-lon-k3s
+10.16.0.5  ssd-lon-5
+10.16.0.7  ssd-lon-7
+10.32.0.3  ssd-ams-3
+10.32.0.4  ssd-ams-4 ssd-ams-ceph ssd-ams-k3s ceph k3s
+10.32.0.5  ssd-ams-5
+10.48.0.1  htz-fsn-1 htz-fsn-ceph htz-fsn-k3s
+10.64.0.3  ssd-nyc-3 ssd-nyc-ceph ssd-nyc-k3s
+
+10.0.1.3  ssd-lon-3-0
+10.0.2.3  ssd-ams-3-0
+10.0.3.1  htz-fsn-1-0
+10.0.4.3  ssd-nyc-3-0

m/ssd-ams/ssd-ams-5/region

@@ -0,0 +1 @@
+none

m/ssd-ams/ssd-ams-5/wg1.conf

@@ -0,0 +1,17 @@
+[Interface]
+# Name: ssd-ams-5-1
+Address = 10.32.0.5
+PrivateKey = mJaFvu9TBwE2i0rjhfhvpB3xZmp++3BVwa7QAvWXImY=
+ListenPort = 51810
+
+[Peer]
+# Name: ssd-ams-3-1
+PublicKey = 9i0XI358OOYYoxoxV5lX8siqE8uiEwCsuWLo6LoFu0Y=
+Endpoint = ssd-ams-3.m.jpi.cloud:51810
+AllowedIPs = 10.32.0.3/32, 10.16.0.0/12, 10.48.0.0/12, 10.64.0.0/12, 10.0.1.3/32, 10.0.2.3/32, 10.0.3.1/32, 10.0.4.3/32
+
+[Peer]
+# Name: ssd-ams-4-1
+PublicKey = QpJupYlnJc7wc3+gAlEmbFMonsqpVnYRy7f/gnPqqBw=
+Endpoint = ssd-ams-4.m.jpi.cloud:51810
+AllowedIPs = 10.32.0.4/32

m/ssd-ams/ssd-ams-5/wg1.key

@@ -0,0 +1 @@
+mJaFvu9TBwE2i0rjhfhvpB3xZmp++3BVwa7QAvWXImY=

m/ssd-ams/ssd-ams-5/wg1.pub

@@ -0,0 +1 @@
+HDLVEwLv0uugyZ9C1C9ZWuiaWQ1qIqqe/DAUxYI0whM=

m/ssd-lon/regions

@@ -0,0 +1 @@
+uk

m/ssd-lon/ssd-lon-3/hosts

@@ -0,0 +1,24 @@
+127.0.0.1 localhost
+
+# The following lines are desirable for IPv6 capable hosts
+::1     ip6-localhost ip6-loopback
+fe00::0 ip6-localnet
+ff00::0 ip6-mcastprefix
+ff02::1 ip6-allnodes
+ff02::2 ip6-allrouters
+ff02::3 ip6-allhosts
+
+10.16.0.3  ssd-lon-3
+10.16.0.4  ssd-lon-4 ssd-lon-ceph ssd-lon-k3s ceph k3s
+10.16.0.5  ssd-lon-5
+10.16.0.7  ssd-lon-7
+10.32.0.3  ssd-ams-3
+10.32.0.4  ssd-ams-4 ssd-ams-ceph ssd-ams-k3s
+10.32.0.5  ssd-ams-5
+10.48.0.1  htz-fsn-1 htz-fsn-ceph htz-fsn-k3s
+10.64.0.3  ssd-nyc-3 ssd-nyc-ceph ssd-nyc-k3s
+
+10.0.1.3  ssd-lon-3-0
+10.0.2.3  ssd-ams-3-0
+10.0.3.1  htz-fsn-1-0
+10.0.4.3  ssd-nyc-3-0

m/ssd-lon/ssd-lon-3/wg0.conf

@@ -0,0 +1,23 @@
+[Interface]
+# Name: ssd-lon-3-0
+Address = 10.0.1.3
+PrivateKey = WJY1yrd14c0gY4qqq1O8BPck46TVYebXrT+OoMbEqG8=
+ListenPort = 51800
+
+[Peer]
+# Name: ssd-ams-3-0
+PublicKey = y/Gkid2Mjxo1WO9Zi7mh+DETNYKT/AAc3K3bvr9xp3c=
+Endpoint = ssd-ams-3.m.jpi.cloud:51800
+AllowedIPs = 10.32.0.0/12, 10.0.2.3/32
+
+[Peer]
+# Name: htz-fsn-1-0
+PublicKey = K9LYog8vtRFN4nW6dJWMQ9trmRrYuLpbu/Ze5kIiBGw=
+Endpoint = htz-fsn-1.m.jpi.cloud:51800
+AllowedIPs = 10.48.0.0/12, 10.0.3.1/32
+
+[Peer]
+# Name: ssd-nyc-3-0
+PublicKey = 1UFgleUufTszPM1voIcwVhd0DpYZ1HwV05U6p3IS2DE=
+Endpoint = ssd-nyc-3.m.jpi.cloud:51800
+AllowedIPs = 10.64.0.0/12, 10.0.4.3/32

m/ssd-lon/ssd-lon-3/wg0.key

@@ -0,0 +1 @@
+WJY1yrd14c0gY4qqq1O8BPck46TVYebXrT+OoMbEqG8=

m/ssd-lon/ssd-lon-3/wg0.pub

@@ -0,0 +1 @@
+aDXNwapVjufcuQKfBN+waJObe1TaeeaSNl1suA0u+00=

m/ssd-lon/ssd-lon-3/wg1.conf

@@ -0,0 +1,23 @@
+[Interface]
+# Name: ssd-lon-3-1
+Address = 10.16.0.3
+PrivateKey = 2CDO+x8HVKfw1/iqC2WkwIEQyWZsC9XPW1otqxarR0o=
+ListenPort = 51810
+
+[Peer]
+# Name: ssd-lon-4-1
+PublicKey = f7AcZy4H2qfi7BRtRA82VdJAqc+IXU90k88GKBp9piM=
+Endpoint = ssd-lon-4.m.jpi.cloud:51810
+AllowedIPs = 10.16.0.4/32
+
+[Peer]
+# Name: ssd-lon-5-1
+PublicKey = 9cUNKM8TPbD8BRjV7TG9/BuTq+2JO8KyrPCx69KW+Bk=
+Endpoint = ssd-lon-5.m.jpi.cloud:51810
+AllowedIPs = 10.16.0.5/32
+
+[Peer]
+# Name: ssd-lon-7-1
+PublicKey = XGVXDmxQajHpsgpzgrp+r/ZWxZUaodTpvGBJuLlZ0n4=
+Endpoint = ssd-lon-7.m.jpi.cloud:51810
+AllowedIPs = 10.16.0.7/32

m/ssd-lon/ssd-lon-3/wg1.key

@@ -0,0 +1 @@
+2CDO+x8HVKfw1/iqC2WkwIEQyWZsC9XPW1otqxarR0o=

m/ssd-lon/ssd-lon-3/wg1.pub

@@ -0,0 +1 @@
+untmMfW2W4OiMgG/6nAysoivXtDh7cZ9/rxhgJ4OlC4=

m/ssd-lon/ssd-lon-4/hosts

@@ -0,0 +1,24 @@
+127.0.0.1 localhost
+
+# The following lines are desirable for IPv6 capable hosts
+::1     ip6-localhost ip6-loopback
+fe00::0 ip6-localnet
+ff00::0 ip6-mcastprefix
+ff02::1 ip6-allnodes
+ff02::2 ip6-allrouters
+ff02::3 ip6-allhosts
+
+10.16.0.3  ssd-lon-3
+10.16.0.4  ssd-lon-4 ssd-lon-ceph ssd-lon-k3s ceph k3s
+10.16.0.5  ssd-lon-5
+10.16.0.7  ssd-lon-7
+10.32.0.3  ssd-ams-3
+10.32.0.4  ssd-ams-4 ssd-ams-ceph ssd-ams-k3s
+10.32.0.5  ssd-ams-5
+10.48.0.1  htz-fsn-1 htz-fsn-ceph htz-fsn-k3s
+10.64.0.3  ssd-nyc-3 ssd-nyc-ceph ssd-nyc-k3s
+
+10.0.1.3  ssd-lon-3-0
+10.0.2.3  ssd-ams-3-0
+10.0.3.1  htz-fsn-1-0
+10.0.4.3  ssd-nyc-3-0

m/ssd-lon/ssd-lon-4/wg1.conf

@@ -0,0 +1,23 @@
+[Interface]
+# Name: ssd-lon-4-1
+Address = 10.16.0.4
+PrivateKey = wE05rSTPSlX9CUdyglpRsNqMVdh8bZSvmUlalGXArEE=
+ListenPort = 51810
+
+[Peer]
+# Name: ssd-lon-3-1
+PublicKey = untmMfW2W4OiMgG/6nAysoivXtDh7cZ9/rxhgJ4OlC4=
+Endpoint = ssd-lon-3.m.jpi.cloud:51810
+AllowedIPs = 10.16.0.3/32, 10.32.0.0/12, 10.48.0.0/12, 10.64.0.0/12, 10.0.1.3/32, 10.0.2.3/32, 10.0.3.1/32, 10.0.4.3/32
+
+[Peer]
+# Name: ssd-lon-5-1
+PublicKey = 9cUNKM8TPbD8BRjV7TG9/BuTq+2JO8KyrPCx69KW+Bk=
+Endpoint = ssd-lon-5.m.jpi.cloud:51810
+AllowedIPs = 10.16.0.5/32
+
+[Peer]
+# Name: ssd-lon-7-1
+PublicKey = XGVXDmxQajHpsgpzgrp+r/ZWxZUaodTpvGBJuLlZ0n4=
+Endpoint = ssd-lon-7.m.jpi.cloud:51810
+AllowedIPs = 10.16.0.7/32

m/ssd-lon/ssd-lon-4/wg1.key

@@ -0,0 +1 @@
+wE05rSTPSlX9CUdyglpRsNqMVdh8bZSvmUlalGXArEE=

m/ssd-lon/ssd-lon-4/wg1.pub

@@ -0,0 +1 @@
+f7AcZy4H2qfi7BRtRA82VdJAqc+IXU90k88GKBp9piM=

m/ssd-lon/ssd-lon-5/hosts

@@ -0,0 +1,24 @@
+127.0.0.1 localhost
+
+# The following lines are desirable for IPv6 capable hosts
+::1     ip6-localhost ip6-loopback
+fe00::0 ip6-localnet
+ff00::0 ip6-mcastprefix
+ff02::1 ip6-allnodes
+ff02::2 ip6-allrouters
+ff02::3 ip6-allhosts
+
+10.16.0.3  ssd-lon-3
+10.16.0.4  ssd-lon-4 ssd-lon-ceph ssd-lon-k3s ceph k3s
+10.16.0.5  ssd-lon-5
+10.16.0.7  ssd-lon-7
+10.32.0.3  ssd-ams-3
+10.32.0.4  ssd-ams-4 ssd-ams-ceph ssd-ams-k3s
+10.32.0.5  ssd-ams-5
+10.48.0.1  htz-fsn-1 htz-fsn-ceph htz-fsn-k3s
+10.64.0.3  ssd-nyc-3 ssd-nyc-ceph ssd-nyc-k3s
+
+10.0.1.3  ssd-lon-3-0
+10.0.2.3  ssd-ams-3-0
+10.0.3.1  htz-fsn-1-0
+10.0.4.3  ssd-nyc-3-0

m/ssd-lon/ssd-lon-5/wg1.conf

@@ -0,0 +1,23 @@
+[Interface]
+# Name: ssd-lon-5-1
+Address = 10.16.0.5
+PrivateKey = oMLrZ8ZmNeWrVroGTh9lx9cJC1enWCF5VfIkv8t+jmk=
+ListenPort = 51810
+
+[Peer]
+# Name: ssd-lon-3-1
+PublicKey = untmMfW2W4OiMgG/6nAysoivXtDh7cZ9/rxhgJ4OlC4=
+Endpoint = ssd-lon-3.m.jpi.cloud:51810
+AllowedIPs = 10.16.0.3/32, 10.32.0.0/12, 10.48.0.0/12, 10.64.0.0/12, 10.0.1.3/32, 10.0.2.3/32, 10.0.3.1/32, 10.0.4.3/32
+
+[Peer]
+# Name: ssd-lon-4-1
+PublicKey = f7AcZy4H2qfi7BRtRA82VdJAqc+IXU90k88GKBp9piM=
+Endpoint = ssd-lon-4.m.jpi.cloud:51810
+AllowedIPs = 10.16.0.4/32
+
+[Peer]
+# Name: ssd-lon-7-1
+PublicKey = XGVXDmxQajHpsgpzgrp+r/ZWxZUaodTpvGBJuLlZ0n4=
+Endpoint = ssd-lon-7.m.jpi.cloud:51810
+AllowedIPs = 10.16.0.7/32

m/ssd-lon/ssd-lon-5/wg1.key

@@ -0,0 +1 @@
+oMLrZ8ZmNeWrVroGTh9lx9cJC1enWCF5VfIkv8t+jmk=

m/ssd-lon/ssd-lon-5/wg1.pub

@@ -0,0 +1 @@
+9cUNKM8TPbD8BRjV7TG9/BuTq+2JO8KyrPCx69KW+Bk=

m/ssd-lon/ssd-lon-7/hosts

@@ -0,0 +1,24 @@
+127.0.0.1 localhost
+
+# The following lines are desirable for IPv6 capable hosts
+::1     ip6-localhost ip6-loopback
+fe00::0 ip6-localnet
+ff00::0 ip6-mcastprefix
+ff02::1 ip6-allnodes
+ff02::2 ip6-allrouters
+ff02::3 ip6-allhosts
+
+10.16.0.3  ssd-lon-3
+10.16.0.4  ssd-lon-4 ssd-lon-ceph ssd-lon-k3s ceph k3s
+10.16.0.5  ssd-lon-5
+10.16.0.7  ssd-lon-7
+10.32.0.3  ssd-ams-3
+10.32.0.4  ssd-ams-4 ssd-ams-ceph ssd-ams-k3s
+10.32.0.5  ssd-ams-5
+10.48.0.1  htz-fsn-1 htz-fsn-ceph htz-fsn-k3s
+10.64.0.3  ssd-nyc-3 ssd-nyc-ceph ssd-nyc-k3s
+
+10.0.1.3  ssd-lon-3-0
+10.0.2.3  ssd-ams-3-0
+10.0.3.1  htz-fsn-1-0
+10.0.4.3  ssd-nyc-3-0

m/ssd-lon/ssd-lon-7/wg1.conf

@@ -0,0 +1,23 @@
+[Interface]
+# Name: ssd-lon-7-1
+Address = 10.16.0.7
+PrivateKey = iN4Rc3J36APlkIP/ksSpHIwAuxC/ehYLwGQ5va1AhG8=
+ListenPort = 51810
+
+[Peer]
+# Name: ssd-lon-3-1
+PublicKey = untmMfW2W4OiMgG/6nAysoivXtDh7cZ9/rxhgJ4OlC4=
+Endpoint = ssd-lon-3.m.jpi.cloud:51810
+AllowedIPs = 10.16.0.3/32, 10.32.0.0/12, 10.48.0.0/12, 10.64.0.0/12, 10.0.1.3/32, 10.0.2.3/32, 10.0.3.1/32, 10.0.4.3/32
+
+[Peer]
+# Name: ssd-lon-4-1
+PublicKey = f7AcZy4H2qfi7BRtRA82VdJAqc+IXU90k88GKBp9piM=
+Endpoint = ssd-lon-4.m.jpi.cloud:51810
+AllowedIPs = 10.16.0.4/32
+
+[Peer]
+# Name: ssd-lon-5-1
+PublicKey = 9cUNKM8TPbD8BRjV7TG9/BuTq+2JO8KyrPCx69KW+Bk=
+Endpoint = ssd-lon-5.m.jpi.cloud:51810
+AllowedIPs = 10.16.0.5/32

m/ssd-lon/ssd-lon-7/wg1.key

@@ -0,0 +1 @@
+iN4Rc3J36APlkIP/ksSpHIwAuxC/ehYLwGQ5va1AhG8=

m/ssd-lon/ssd-lon-7/wg1.pub

@@ -0,0 +1 @@
+XGVXDmxQajHpsgpzgrp+r/ZWxZUaodTpvGBJuLlZ0n4=

m/ssd-nyc/regions

@@ -0,0 +1 @@
+us

m/ssd-nyc/ssd-nyc-3/hosts

@@ -0,0 +1,24 @@
+127.0.0.1 localhost
+
+# The following lines are desirable for IPv6 capable hosts
+::1     ip6-localhost ip6-loopback
+fe00::0 ip6-localnet
+ff00::0 ip6-mcastprefix
+ff02::1 ip6-allnodes
+ff02::2 ip6-allrouters
+ff02::3 ip6-allhosts
+
+10.16.0.3  ssd-lon-3
+10.16.0.4  ssd-lon-4 ssd-lon-ceph ssd-lon-k3s
+10.16.0.5  ssd-lon-5
+10.16.0.7  ssd-lon-7
+10.32.0.3  ssd-ams-3
+10.32.0.4  ssd-ams-4 ssd-ams-ceph ssd-ams-k3s
+10.32.0.5  ssd-ams-5
+10.48.0.1  htz-fsn-1 htz-fsn-ceph htz-fsn-k3s
+10.64.0.3  ssd-nyc-3 ssd-nyc-ceph ssd-nyc-k3s ceph k3s
+
+10.0.1.3  ssd-lon-3-0
+10.0.2.3  ssd-ams-3-0
+10.0.3.1  htz-fsn-1-0
+10.0.4.3  ssd-nyc-3-0

m/ssd-nyc/ssd-nyc-3/region

@@ -0,0 +1 @@
+none

m/ssd-nyc/ssd-nyc-3/wg0.conf

@@ -0,0 +1,23 @@
+[Interface]
+# Name: ssd-nyc-3-0
+Address = 10.0.4.3
+PrivateKey = YNDxj+QSO3p5pXw9h7lBx0cLM0kJDv3v7BYLfc8TR3I=
+ListenPort = 51800
+
+[Peer]
+# Name: ssd-lon-3-0
+PublicKey = aDXNwapVjufcuQKfBN+waJObe1TaeeaSNl1suA0u+00=
+Endpoint = ssd-lon-3.m.jpi.cloud:51800
+AllowedIPs = 10.16.0.0/12, 10.0.1.3/32
+
+[Peer]
+# Name: ssd-ams-3-0
+PublicKey = y/Gkid2Mjxo1WO9Zi7mh+DETNYKT/AAc3K3bvr9xp3c=
+Endpoint = ssd-ams-3.m.jpi.cloud:51800
+AllowedIPs = 10.32.0.0/12, 10.0.2.3/32
+
+[Peer]
+# Name: htz-fsn-1-0
+PublicKey = K9LYog8vtRFN4nW6dJWMQ9trmRrYuLpbu/Ze5kIiBGw=
+Endpoint = htz-fsn-1.m.jpi.cloud:51800
+AllowedIPs = 10.48.0.0/12, 10.0.3.1/32

m/ssd-nyc/ssd-nyc-3/wg0.key

@@ -0,0 +1 @@
+YNDxj+QSO3p5pXw9h7lBx0cLM0kJDv3v7BYLfc8TR3I=

m/ssd-nyc/ssd-nyc-3/wg0.pub

@@ -0,0 +1 @@
+1UFgleUufTszPM1voIcwVhd0DpYZ1HwV05U6p3IS2DE=

m/ssd-nyc/ssd-nyc-3/wg1.conf

@@ -0,0 +1,5 @@
+[Interface]
+# Name: ssd-nyc-3-1
+Address = 10.64.0.3
+PrivateKey = APXGKqOxx1gOr587FSN3O3gRGpkGgSjt6zGlTu49UlU=
+ListenPort = 51810

m/ssd-nyc/ssd-nyc-3/wg1.key

@@ -0,0 +1 @@
+APXGKqOxx1gOr587FSN3O3gRGpkGgSjt6zGlTu49UlU=

m/ssd-nyc/ssd-nyc-3/wg1.pub

@@ -0,0 +1 @@
+av8ni/9ZUyozabzqTjIy1sOnSJuQ9p63Tu9ECVmHB2I=

pkg/ceph/config.go

@@ -39,6 +39,9 @@ func writeGlobalToBuffer(w *bytes.Buffer, c *GlobalConfig) {
 	_, _ = fmt.Fprintf(w, "%s = %s\n", "mon_initial_members", strings.Join(c.Monitors, ", "))
 	_, _ = fmt.Fprintf(w, "%s = %s\n", "mon_host", joinAddrs(c.MonitorsAddr, ", "))
 	_, _ = fmt.Fprintf(w, "%s = %s\n", "cluster_network", c.ClusterNetwork.String())
+
+	_, _ = fmt.Fprintf(w, "\n; %s\n", "don't rewrite labels on startup")
+	_, _ = fmt.Fprintf(w, "%s = %s\n", "osd_class_update_on_start", "false")
 }
 
 func joinAddrs(addrs []netip.Addr, sep string) string {

pkg/ceph/config_parser.go

@@ -2,9 +2,10 @@ package ceph
 
 import (
 	"io/fs"
-	"log"
+	"net/netip"
 
 	"asciigoat.org/ini/basic"
+	"asciigoat.org/ini/parser"
 
 	"darvaza.org/core"
 )
@@ -35,26 +36,60 @@ func loadGlobalConfSection(out *Config, src *basic.Section) error {
 	return nil
 }
 
+// revive:disable:cyclomatic
+// revive:disable:cognitive-complexity
+
 func loadGlobalConfField(cfg *GlobalConfig, field basic.Field) error {
-	log.Printf("%s[%q] = %q", "global", field.Key, field.Value)
+	// revive:enable:cyclomatic
+	// revive:enable:cognitive-complexity
 
-	key, value := field.Key, field.Value
+	// TODO: refactor when asciigoat's ini parser learns to do reflection
 
-	switch key {
+	switch field.Key {
 	case "fsid":
-		return configFieldHandler(&cfg.FSID, key, value)
+		if !core.IsZero(cfg.FSID) {
-	case "mon_host":
+			return core.Wrap(fs.ErrInvalid, "duplicate field %q", field.Key)
-		return configFieldHandler(&cfg.MonitorsAddr, key, value)
+		}
-	case "mon_initial_members":
-		return configFieldHandler(&cfg.Monitors, key, value)
-	case "cluster_network":
-		return configFieldHandler(&cfg.ClusterNetwork, key, value)
-	default:
-		return core.Wrap(fs.ErrNotExist, "field %q unknown", key)
-	}
-}
 
-func configFieldHandler(vi any, key, value string) error
+		err := cfg.FSID.UnmarshalText([]byte(field.Value))
+		switch {
+		case err != nil:
+			return core.Wrap(err, field.Key)
+		default:
+			return nil
+		}
+	case "mon_host":
+		entries, _ := parser.SplitCommaArray(field.Value)
+		for _, s := range entries {
+			var addr netip.Addr
+
+			if err := addr.UnmarshalText([]byte(s)); err != nil {
+				return core.Wrap(err, field.Key)
+			}
+
+			cfg.MonitorsAddr = append(cfg.MonitorsAddr, addr)
+		}
+		return nil
+	case "mon_initial_members":
+		entries, _ := parser.SplitCommaArray(field.Value)
+		cfg.Monitors = append(cfg.Monitors, entries...)
+		return nil
+	case "cluster_network":
+		if !core.IsZero(cfg.ClusterNetwork) {
+			err := core.Wrap(fs.ErrInvalid, "fields before the first section")
+			return err
+		}
+
+		err := cfg.ClusterNetwork.UnmarshalText([]byte(field.Value))
+		switch {
+		case err != nil:
+			return core.Wrap(err, field.Key)
+		default:
+			return nil
+		}
+	}
+	return nil
+}
 
 func newConfigFromDocument(doc *basic.Document) (*Config, error) {
 	var out Config

pkg/cluster/cluster_scan.go

@@ -4,6 +4,7 @@ import (
 	"io/fs"
 	"path"
 	"sort"
+	"strings"
 
 	"darvaza.org/core"
 )
@@ -12,6 +13,10 @@ const (
 	// ZoneRegionsFileName indicates the file containing
 	// region names as references
 	ZoneRegionsFileName = "regions"
+
+	// RegionClusterTokenFileName contains the kubernetes
+	// token of the cluster this region represents
+	RegionClusterTokenFileName = "k8s_token"
 )
 
 func (m *Cluster) scan(opts *ScanOptions) error {
@@ -186,6 +191,8 @@ func (z *Zone) scan() error {
 		switch {
 		case name == ZoneRegionsFileName:
 			err = z.loadRegions()
+		case name == RegionClusterTokenFileName:
+			err = z.loadClusterToken()
 		case e.IsDir():
 			err = z.scanSubdirectory(name)
 		default:
@@ -218,6 +225,32 @@ func (z *Zone) loadRegions() error {
 	return err
 }
 
+func (z *Zone) loadClusterToken() error {
+	var token string
+
+	filename := path.Join(z.Name, RegionClusterTokenFileName)
+	lines, err := z.zones.ReadLines(filename)
+	if err != nil {
+		return err
+	}
+
+	// first non-empty line
+	for _, s := range lines {
+		s = strings.TrimSpace(s)
+		if s != "" {
+			token = s
+			break
+		}
+	}
+
+	err = z.zones.setRegionClusterToken(z.Name, token)
+	if err != nil {
+		err = core.Wrap(err, filename)
+	}
+
+	return err
+}
+
 func (z *Zone) scanSubdirectory(name string) error {
 	m := &Machine{
 		zone:   z,

pkg/cluster/env.go

@@ -4,12 +4,14 @@ import (
 	"bytes"
 	"fmt"
 	"io"
+	"sort"
 	"strings"
 )
 
 // Env is a shell environment factory for this cluster
 type Env struct {
 	ZoneIterator
+	RegionIterator
 
 	cephFSID string
 	export   bool
@@ -23,9 +25,10 @@ func (m *Cluster) Env(export bool) (*Env, error) {
 	}
 
 	env := &Env{
-		ZoneIterator: m,
+		ZoneIterator:   m,
-		cephFSID:     fsid.String(),
+		RegionIterator: m,
-		export:       export,
+		cephFSID:       fsid.String(),
+		export:         export,
 	}
 
 	return env, nil
@@ -43,6 +46,22 @@ func (m *Env) Zones() []int {
 	return zones
 }
 
+// Regions returns the list of primary regions
+func (m *Env) Regions() []string {
+	var regions []string
+
+	m.ForEachRegion(func(r *Region) bool {
+		if r.Cluster != nil {
+			regions = append(regions, r.Name)
+		}
+
+		return false
+	})
+
+	sort.Strings(regions)
+	return regions
+}
+
 // WriteTo generates environment variables for shell scripts
 func (m *Env) WriteTo(w io.Writer) (int64, error) {
 	var buf bytes.Buffer
@@ -51,6 +70,7 @@ func (m *Env) WriteTo(w io.Writer) (int64, error) {
 		m.writeEnvVar(&buf, m.cephFSID, "FSID")
 	}
 
+	m.writeEnvVarStrings(&buf, m.Regions(), "REGIONS")
 	m.writeEnvVarInts(&buf, m.Zones(), "ZONES")
 
 	m.ForEachZone(func(z *Zone) bool {
@@ -74,6 +94,9 @@ func (m *Env) writeEnvZone(w io.Writer, z *Zone) {
 	gateways, _ := z.GatewayIDs()
 	m.writeEnvVarInts(w, gateways, "ZONE%v_%s", zoneID, "GW")
 
+	// ZONE{zoneID}_REGION
+	m.writeEnvVar(w, genEnvZoneRegion(z), "ZONE%v_%s", zoneID, "REGION")
+
 	// Ceph
 	monitors := z.GetCephMonitors()
 	// MON{zoneID}_NAME
@@ -85,22 +108,29 @@ func (m *Env) writeEnvZone(w io.Writer, z *Zone) {
 }
 
 func (m *Env) writeEnvVarInts(w io.Writer, value []int, name string, args ...any) {
-	var s string
+	var buf bytes.Buffer
 
-	if n := len(value); n > 0 {
+	for _, v := range value {
-		var buf bytes.Buffer
+		if buf.Len() > 0 {
-
+			_, _ = fmt.Fprint(&buf, " ")
-		for i, v := range value {
-			if i != 0 {
-				_, _ = fmt.Fprint(&buf, " ")
-			}
-			_, _ = fmt.Fprintf(&buf, "%v", v)
 		}
-
+		_, _ = fmt.Fprintf(&buf, "%v", v)
-		s = buf.String()
 	}
 
-	m.writeEnvVar(w, s, name, args...)
+	m.writeEnvVar(w, buf.String(), name, args...)
+}
+
+func (m *Env) writeEnvVarStrings(w io.Writer, value []string, name string, args ...any) {
+	var buf bytes.Buffer
+
+	for _, v := range value {
+		if buf.Len() > 0 {
+			_, _ = fmt.Fprint(&buf, " ")
+		}
+		_, _ = fmt.Fprintf(&buf, "%s", v)
+	}
+
+	m.writeEnvVar(w, buf.String(), name, args...)
 }
 
 func (m *Env) writeEnvVar(w io.Writer, value string, name string, args ...any) {
@@ -117,7 +147,11 @@ func (m *Env) writeEnvVar(w io.Writer, value string, name string, args ...any) {
 	if name != "" {
 		value = strings.TrimSpace(value)
 
-		_, _ = fmt.Fprintf(w, "%s%s=%q\n", prefix, name, value)
+		if value == "" {
+			_, _ = fmt.Fprintf(w, "%s%s=\n", prefix, name)
+		} else {
+			_, _ = fmt.Fprintf(w, "%s%s=%q\n", prefix, name, value)
+		}
 	}
 }
 
@@ -135,6 +169,21 @@ func genEnvZoneNodes(z *Zone) string {
 	return ""
 }
 
+func genEnvZoneRegion(z *Zone) string {
+	var region string
+
+	z.ForEachRegion(func(r *Region) bool {
+		if r.Cluster != nil {
+			region = r.Name
+			return true
+		}
+
+		return false
+	})
+
+	return region
+}
+
 func genEnvZoneCephMonNames(m Machines) string {
 	var buf strings.Builder
 	m.ForEachMachine(func(p *Machine) bool {

pkg/cluster/regions.go

@@ -8,14 +8,23 @@ import (
 var (
 	_ MachineIterator = (*Region)(nil)
 	_ ZoneIterator    = (*Region)(nil)
+
+	_ RegionIterator = (*Zone)(nil)
+	_ RegionIterator = (*Cluster)(nil)
 )
 
+// A RegionIterator is a set of Regions we can iterate on
+type RegionIterator interface {
+	ForEachRegion(func(*Region) bool)
+}
+
 // Region represents a group of zones geographically related
 type Region struct {
 	m     *Cluster
 	zones []*Zone
 
 	Name    string
+	Cluster *string  `json:",omitempty" yaml:",omitempty"`
 	Regions []string `json:",omitempty" yaml:",omitempty"`
 }
 
@@ -106,6 +115,26 @@ func (m *Cluster) setRegionZones(name string, zones ...*Zone) {
 	})
 }
 
+func (m *Cluster) setRegionClusterToken(name string, token string) error {
+	for i := range m.Regions {
+		r := &m.Regions[i]
+
+		if r.Name == name {
+			// found
+			r.Cluster = &token
+			return nil
+		}
+	}
+
+	// new
+	m.Regions = append(m.Regions, Region{
+		m:       m,
+		Name:    name,
+		Cluster: &token,
+	})
+	return nil
+}
+
 func (m *Cluster) appendRegionRegions(name string, subs ...string) {
 	for i := range m.Regions {
 		r := &m.Regions[i]
@@ -124,6 +153,28 @@ func (m *Cluster) appendRegionRegions(name string, subs ...string) {
 	})
 }
 
+// ForEachRegion calls a function on all regions this zone belongs to.
+func (z *Zone) ForEachRegion(fn func(*Region) bool) {
+	if fn == nil {
+		return
+	}
+
+	z.zones.ForEachRegion(func(r *Region) bool {
+		var match bool
+
+		r.ForEachZone(func(z2 *Zone) bool {
+			match = (z == z2)
+			return match
+		})
+
+		if match && fn(r) {
+			return true
+		}
+
+		return false
+	})
+}
+
 func (z *Zone) appendRegions(regions ...string) error {
 	for _, s := range regions {
 		// TODO: validate
@@ -147,7 +198,7 @@ func (m *Cluster) finishRegion(r *Region) {
 	r.m = m
 	sub := []string{}
 	for _, name := range r.Regions {
-		r2, ok := m.getRegion(name)
+		r2, ok := m.getFinishRegion(name)
 		if !ok {
 			m.warn(nil).WithField("region", name).Print("unknown region")
 			continue
@@ -162,9 +213,7 @@ func (m *Cluster) finishRegion(r *Region) {
 func (m *Cluster) getRegion(name string) (*Region, bool) {
 	for i := range m.Regions {
 		r := &m.Regions[i]
-
 		if name == r.Name {
-			m.finishRegion(r)
 			return r, true
 		}
 	}
@@ -172,17 +221,22 @@ func (m *Cluster) getRegion(name string) (*Region, bool) {
 	return nil, false
 }
 
+func (m *Cluster) getFinishRegion(name string) (*Region, bool) {
+	if r, ok := m.getRegion(name); ok {
+		m.finishRegion(r)
+		return r, true
+	}
+
+	return nil, false
+}
+
 // SyncRegions writes to the file system the regions this [Zone]
 // belongs to.
 func (z *Zone) SyncRegions() error {
 	err := z.syncZoneRegions()
 	if err == nil {
 		z.ForEachMachine(func(p *Machine) bool {
-			if p.IsActive() {
+			err = z.syncMachineRegions(p)
-				err = p.RemoveFile("region")
-			} else {
-				err = p.WriteStringFile("none\n", "region")
-			}
 			return err != nil
 		})
 	}
@@ -190,8 +244,24 @@ func (z *Zone) SyncRegions() error {
 	return err
 }
 
+func (*Zone) syncMachineRegions(p *Machine) error {
+	var err error
+
+	if p.IsActive() {
+		err = p.RemoveFile("region")
+	} else {
+		err = p.WriteStringFile("none\n", "region")
+	}
+
+	if err == nil {
+		err = p.RemoveFile(RegionClusterTokenFileName)
+	}
+
+	return err
+}
+
 func (z *Zone) syncZoneRegions() error {
-	name := filepath.Join(z.Name, "regions")
+	name := filepath.Join(z.Name, ZoneRegionsFileName)
 
 	if len(z.Regions) > 0 {
 		var buf bytes.Buffer
@@ -210,9 +280,25 @@ func (z *Zone) syncZoneRegions() error {
 // SyncRegions writes to the file system the regions covered
 // by this meta-region
 func (r *Region) SyncRegions() error {
-	name := filepath.Join(r.Name, "regions")
+	if err := r.syncRegionsFile(); err != nil {
+		return err
+	}
 
-	if len(r.Regions) > 0 {
+	return r.syncClusterFile()
+}
+
+func (r *Region) mkdir() error {
+	return r.m.MkdirAll(r.Name)
+}
+
+func (r *Region) syncRegionsFile() error {
+	var err error
+
+	name := filepath.Join(r.Name, ZoneRegionsFileName)
+
+	if len(r.Regions) == 0 {
+		err = r.m.RemoveFile(name)
+	} else if err = r.mkdir(); err == nil {
 		var buf bytes.Buffer
 
 		for _, s := range r.Regions {
@@ -220,12 +306,29 @@ func (r *Region) SyncRegions() error {
 			_, _ = buf.WriteRune('\n')
 		}
 
-		if err := r.m.MkdirAll(r.Name); err != nil {
+		err = r.m.WriteStringFile(buf.String(), name)
-			return err
-		}
-
-		return r.m.WriteStringFile(buf.String(), name)
 	}
 
-	return r.m.RemoveFile(name)
+	return err
+}
+
+func (r *Region) syncClusterFile() error {
+	var err error
+
+	name := filepath.Join(r.Name, RegionClusterTokenFileName)
+
+	if r.Cluster == nil {
+		err = r.m.RemoveFile(name)
+	} else if err = r.mkdir(); err == nil {
+		var buf bytes.Buffer
+
+		_, _ = buf.WriteString(*r.Cluster)
+		if buf.Len() > 0 {
+			_, _ = buf.WriteRune('\n')
+		}
+
+		err = r.m.WriteStringFile(buf.String(), name)
+	}
+
+	return err
 }

pkg/wireguard/config.go

@@ -78,7 +78,7 @@ type PeerConfig struct {
 	Name       string
 	PublicKey  PublicKey
 	Endpoint   EndpointAddress
-	AllowedIPs []netip.Prefix `ini:",comma"`
+	AllowedIPs []netip.Prefix
 }
 
 // EndpointAddress is a host:port pair to reach the Peer

pkg/wireguard/config_parser.go

@@ -2,7 +2,7 @@ package wireguard
 
 import (
 	"io/fs"
-	"log"
+	"strconv"
 
 	"asciigoat.org/ini/basic"
 	"darvaza.org/core"
@@ -50,42 +50,106 @@ func loadPeerConfSection(out *Config, src *basic.Section) error {
 	return nil
 }
 
-func configFieldHandler(vi any, key, value string) error
+// revive:disable:cyclomatic
+// revive:disable:cognitive-complexity
 
 func loadInterfaceConfField(cfg *InterfaceConfig, field basic.Field) error {
-	log.Printf("%s[%q] = %q", "Interface", field.Key, field.Value)
+	// revive:enable:cyclomatic
+	// revive:enable:cognitive-complexity
 
-	key, value := field.Key, field.Value
+	// TODO: refactor when asciigoat's ini parser learns to do reflection
-
+	switch field.Key {
-	switch key {
 	case "Address":
-		return configFieldHandler(&cfg.Address, key, value)
+		if !core.IsZero(cfg.Address) {
+			return core.Wrap(fs.ErrInvalid, "duplicate field %q", field.Key)
+		}
+
+		err := cfg.Address.UnmarshalText([]byte(field.Value))
+		switch {
+		case err != nil:
+			return core.Wrap(err, field.Key)
+		default:
+			return nil
+		}
 	case "PrivateKey":
-		return configFieldHandler(&cfg.PrivateKey, key, value)
+		if !core.IsZero(cfg.PrivateKey) {
+			return core.Wrap(fs.ErrInvalid, "duplicate field %q", field.Key)
+		}
+
+		err := cfg.PrivateKey.UnmarshalText([]byte(field.Value))
+		switch {
+		case err != nil:
+			return core.Wrap(err, field.Key)
+		default:
+			return nil
+		}
 	case "ListenPort":
-		return configFieldHandler(&cfg.ListenPort, key, value)
+		if cfg.ListenPort > 0 {
-	default:
+			return core.Wrap(fs.ErrInvalid, "duplicate field %q", field.Key)
-		return core.Wrap(fs.ErrInvalid, "unknown field %q", key)
+		}
-	}
-}
 
-func loadPeerConfField(cfg *PeerConfig, field basic.Field) error {
+		u64, err := strconv.ParseUint(field.Value, 10, 16)
-	log.Printf("%s[%q] = %q", "Peer", field.Key, field.Value)
+		switch {
-
+		case err != nil:
-	key, value := field.Key, field.Value
+			return core.Wrap(err, field.Key)
-
+		case u64 == 0:
-	switch key {
+			return core.Wrap(fs.ErrInvalid, "invalid %q value", field.Key)
-	case "PublicKey":
+		default:
-		return configFieldHandler(&cfg.PublicKey, key, value)
+			cfg.ListenPort = uint16(u64)
-	case "Endpoint":
+			return nil
-		return configFieldHandler(&cfg.Endpoint, key, value)
+		}
-	case "AllowedIPs":
-		return configFieldHandler(&cfg.AllowedIPs, key, value)
 	default:
 		return core.Wrap(fs.ErrInvalid, "unknown field %q", field.Key)
 	}
 }
 
+// revive:disable:cyclomatic
+// revive:disable:cognitive-complexity
+
+func loadPeerConfField(cfg *PeerConfig, field basic.Field) error {
+	// revive:enable:cyclomatic
+	// revive:enable:cognitive-complexity
+
+	switch field.Key {
+	case "PublicKey":
+		if !core.IsZero(cfg.PublicKey) {
+			return core.Wrap(fs.ErrInvalid, "duplicate field %q", field.Key)
+		}
+
+		err := cfg.PublicKey.UnmarshalText([]byte(field.Value))
+		switch {
+		case err != nil:
+			return core.Wrap(err, field.Key)
+		default:
+			return nil
+		}
+	case "Endpoint":
+		if cfg.Endpoint.String() != "" {
+			return core.Wrap(fs.ErrInvalid, "duplicate field %q", field.Key)
+		}
+
+		err := cfg.Endpoint.UnmarshalText([]byte(field.Value))
+		switch {
+		case err != nil:
+			return core.Wrap(err, field.Key)
+		default:
+			return nil
+		}
+	case "AllowedIPs":
+		s, err := parseAllowedIPs(field.Value)
+		switch {
+		case err != nil:
+			return core.Wrap(err, field.Key)
+		case len(s) > 0:
+			cfg.AllowedIPs = append(cfg.AllowedIPs, s...)
+			return nil
+		}
+	default:
+		return core.Wrap(fs.ErrInvalid, "unknown field %q", field.Key)
+	}
+	return nil
+}
+
 func newConfigFromDocument(doc *basic.Document) (*Config, error) {
 	var out Config