deploy-openstack.sh

#!/bin/bash
#
# OpenStack Antelope 双节点一键部署脚本
# 基于 openEuler 24.03 LTS SP2
# 参考: openEuler OpenStack SIG 官方文档
#
set -euo pipefail

# ─── 全局变量 ─────────────────────────────────────────────────
SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
STATE_FILE="$SCRIPT_DIR/.deploy_state"
LOG_DIR="/var/log/openstack-deploy"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
LOG_FILE="$LOG_DIR/deploy-$TIMESTAMP.log"
BACKUP_DIR="$HOME/openstack-deploy/backup"

NODE_TYPE=""
MGMT_IP=""
CONTROLLER_IP=""
COMPUTE_IP=""
PROVIDER_IFACE=""
COMPUTE_PROVIDER_IFACE=""
COMPUTE_ROOT_PASS=""
PASSWORD_MODE=""
DEPLOY_MODE=""
STATIC_IP_ENABLED="yes"
COMPUTE_STATIC_IP_ENABLED="yes"
DEFAULT_PASS="123456"
CINDER_DISK=""
SWIFT_LOOPBACK=false

# 所有密码变量,默认值 123456
ADMIN_PASS="$DEFAULT_PASS"
RABBIT_PASS="$DEFAULT_PASS"
KEYSTONE_DBPASS="$DEFAULT_PASS"
GLANCE_PASS="$DEFAULT_PASS"
GLANCE_DBPASS="$DEFAULT_PASS"
PLACEMENT_PASS="$DEFAULT_PASS"
PLACEMENT_DBPASS="$DEFAULT_PASS"
NOVA_PASS="$DEFAULT_PASS"
NOVA_DBPASS="$DEFAULT_PASS"
NEUTRON_PASS="$DEFAULT_PASS"
NEUTRON_DBPASS="$DEFAULT_PASS"
CINDER_PASS="$DEFAULT_PASS"
CINDER_DBPASS="$DEFAULT_PASS"
SWIFT_PASS="$DEFAULT_PASS"
METADATA_SECRET="$DEFAULT_PASS"

# 架构检测
ARCH=$(uname -m)
IS_ARM=false
[[ "$ARCH" == "aarch64" ]] && IS_ARM=true

# ─── 颜色输出 ─────────────────────────────────────────────────
RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
BLUE='\033[0;34m'
CYAN='\033[0;36m'
NC='\033[0m'

# ─── 辅助函数 ─────────────────────────────────────────────────
log()       { local msg="[$(date '+%H:%M:%S')] $*"; echo -e "$msg" | tee -a "$LOG_FILE"; }
info()      { log "${BLUE}[INFO]${NC}  $*"; }
warn()      { log "${YELLOW}[WARN]${NC}  $*"; }
success()   { log "${GREEN}[OK]${NC}    $*"; }
error()     { log "${RED}[ERROR]${NC} $*"; exit 1; }
step()      { echo ""; log "${CYAN}════════════════════════════════════════${NC}"; log "${CYAN}  $*${NC}"; log "${CYAN}════════════════════════════════════════${NC}"; }

# 运行长时间命令，实时显示输出同时写入日志
run_verbose() {
    local desc="$1"; shift
    info "$desc ..."
    "$@" 2>&1 | tee -a "$LOG_FILE"
    local rc=${PIPESTATUS[0]}
    if [[ $rc -ne 0 ]]; then
        error "$desc 失败 (exit code: $rc)"
    fi
    success "$desc 完成"
}

# 安静运行，输出只写日志
run_quiet() {
    local desc="$1"; shift
    info "$desc ..."
    if "$@" >> "$LOG_FILE" 2>&1; then
        success "$desc 完成"
    else
        error "$desc 失败"
    fi
}

check_root() {
    [[ "$(id -u)" -eq 0 ]] || error "请以 root 用户运行此脚本"
}

# 幂等检查: 某阶段是否已完成
is_stage_done() {
    local stage="$1"
    [[ -f "$STATE_FILE" ]] && grep -q "^COMPLETED=.*\<${stage}\>" "$STATE_FILE" 2>/dev/null
}

# 标记阶段完成
mark_stage() {
    local stage="$1"
    if grep -q "^COMPLETED=" "$STATE_FILE" 2>/dev/null; then
        sed -i "s/^COMPLETED=.*/&,${stage}/" "$STATE_FILE"
    else
        echo "COMPLETED=${stage}" >> "$STATE_FILE"
    fi
    success "阶段 [$stage] 完成"
}

# 跳过已完成的阶段
skip_if_done() {
    local stage="$1"
    if is_stage_done "$stage"; then
        step "阶段 [$stage] 已完成，跳过 (--force $stage 强制重跑)"
        return 0
    fi
    return 1
}

# Keystone 幂等: 不存在才创建
svc_create() { openstack service list 2>/dev/null | grep -q "$1" || openstack service create --name "$1" "$2"; }
ep_create()  { openstack endpoint list 2>/dev/null | grep -q "$1" || openstack endpoint create --region RegionOne "$1" "$2"; }

# 使用 crudini 设置配置,没有 crudini 则用 openstack-config
ini_set() {
    local file="$1" section="$2" key="$3" value="$4"
    # 备份文件(只备份一次)
    local bak="$BACKUP_DIR/$(basename "$file").orig"
    if [[ ! -f "$bak" ]]; then
        mkdir -p "$BACKUP_DIR"
        cp "$file" "$bak" 2>/dev/null || true
    fi
    if command -v crudini &>/dev/null; then
        crudini --set "$file" "$section" "$key" "$value"
    elif command -v openstack-config &>/dev/null; then
        openstack-config --set "$file" "$section" "$key" "$value"
    else
        # fallback: sed
        if grep -q "^#*\s*${key}\s*=" "$file" 2>/dev/null; then
            sed -i "s|^#*\s*${key}\s*=.*|${key} = ${value}|" "$file"
        else
            # 在对应 section 下插入
            sed -i "/^\[${section}\]/a ${key} = ${value}" "$file"
        fi
    fi
}

# 等待服务端口就绪
wait_port() {
    local host="$1" port="$2" max="${3:-30}"
    local i=0
    while ! bash -c "echo >/dev/tcp/$host/$port" 2>/dev/null; do
        i=$((i+1))
        if [[ $i -ge $max ]]; then
            warn "等待 $host:$port 超时"
            return 1
        fi
        sleep 2
    done
    return 0
}

# 保存状态文件中的变量
save_state_var() {
    local key="$1" val="$2"
    if grep -q "^${key}=" "$STATE_FILE" 2>/dev/null; then
        sed -i "s|^${key}=.*|${key}=${val}|" "$STATE_FILE"
    else
        echo "${key}=${val}" >> "$STATE_FILE"
    fi
}

get_state_var() {
    local key="$1"
    grep "^${key}=" "$STATE_FILE" 2>/dev/null | cut -d= -f2- || echo ""
}

# 配置 SSH 免密登录到 Controller (Compute 专用)
setup_ssh_to_controller() {
    local ctrl_ip="$1" ctrl_pass="$2"

    if ! command -v sshpass &>/dev/null; then
        dnf install -y sshpass >> "$LOG_FILE" 2>&1 || {
            warn "无法安装 sshpass，回退到手动模式"
            return 1
        }
    fi

    if [[ ! -f ~/.ssh/id_rsa ]]; then
        ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa -N "" -q
    fi

    sshpass -p "$ctrl_pass" ssh-copy-id -o StrictHostKeyChecking=no "root@$ctrl_ip" >> "$LOG_FILE" 2>&1 && {
        success "SSH 免密登录已配置: root@$ctrl_ip"
        return 0
    } || {
        warn "SSH 配置失败，将回退到手动模式"
        return 1
    }
}

# 生成 Compute 节点 state file 内容 (All-in-One 模式用)
generate_compute_state_file() {
    cat <<EOF
NODE_TYPE=compute
MGMT_IP=$COMPUTE_IP
CONTROLLER_IP=$MGMT_IP
PROVIDER_IFACE=$COMPUTE_PROVIDER_IFACE
PASSWORD_MODE=$PASSWORD_MODE
CINDER_DISK=${REMOTE_CINDER_DISK:-}
ADMIN_PASS=$ADMIN_PASS
RABBIT_PASS=$RABBIT_PASS
KEYSTONE_DBPASS=$KEYSTONE_DBPASS
GLANCE_PASS=$GLANCE_PASS
GLANCE_DBPASS=$GLANCE_DBPASS
PLACEMENT_PASS=$PLACEMENT_PASS
PLACEMENT_DBPASS=$PLACEMENT_DBPASS
NOVA_PASS=$NOVA_PASS
NOVA_DBPASS=$NOVA_DBPASS
NEUTRON_PASS=$NEUTRON_PASS
NEUTRON_DBPASS=$NEUTRON_DBPASS
CINDER_PASS=$CINDER_PASS
CINDER_DBPASS=$CINDER_DBPASS
SWIFT_PASS=$SWIFT_PASS
METADATA_SECRET=$METADATA_SECRET
STATIC_IP_ENABLED=${COMPUTE_STATIC_IP_ENABLED:-yes}
EOF
}

# 等待 dnf/yum 锁释放 (避免 dnf 自更新后锁残留导致后续 yum 命令卡住)
wait_dnf() {
    local max="${1:-30}" i=0
    while [[ $i -lt $max ]]; do
        if ! pgrep -x dnf >/dev/null 2>&1 && ! pgrep -x yum >/dev/null 2>&1; then
            return 0
        fi
        sleep 2
        i=$((i+1))
    done
    warn "等待 dnf 锁超时 (${max}s)，尝试清理残留锁"
    rm -f /var/run/dnf.pid /var/run/yum.pid 2>/dev/null || true
    sleep 2
}

# 将管理网卡配置为静态 IP (防止 DHCP 租约过期后 IP 变动)
set_static_ip() {
    local iface="$1" ip="$2"

    if ! command -v nmcli &>/dev/null; then
        warn "nmcli 不可用，跳过静态 IP 配置"
        return 1
    fi

    # 获取该网卡的 NetworkManager 连接名
    local conn
    conn=$(nmcli -t -f GENERAL.CONNECTION dev show "$iface" 2>/dev/null | grep '^GENERAL.CONNECTION:' | cut -d: -f2)
    if [[ -z "$conn" ]]; then
        warn "无法获取 $iface 的 NetworkManager 连接，跳过静态 IP 配置"
        return 1
    fi

    # 计算网关 (同网段 .2)
    local gateway
    gateway=$(echo "$ip" | sed 's/\.[0-9]*$/.2/')

    nmcli con mod "$conn" \
        ipv4.method manual \
        ipv4.addresses "${ip}/24" \
        ipv4.gateway "$gateway" \
        ipv4.dns "8.8.8.8 114.114.114.114" \
        connection.autoconnect yes 2>/dev/null

    nmcli con up "$conn" 2>/dev/null || true
    success "管理网卡 $iface 已配置为静态 IP: $ip/24，网关: $gateway"
    return 0
}

# 检测管理 IP 所在网卡名
detect_mgmt_iface() {
    local ip="$1"
    ip -4 -br addr show | grep -F "$ip" 2>/dev/null | awk '{print $1}' | head -1
}

# ─── 系统检测 ─────────────────────────────────────────────────
check_os() {
    if [[ ! -f /etc/openEuler-release ]]; then
        error "此脚本仅支持 openEuler 系统"
    fi
    local ver
    ver=$(cat /etc/openEuler-release)
    info "系统: $ver"
    if ! echo "$ver" | grep -q "24.03"; then
        warn "建议使用 openEuler 24.03 LTS SP2，当前版本: $ver"
        warn "继续部署可能存在兼容性问题"
    fi
    local mem
    mem=$(grep MemTotal /proc/meminfo | awk '{print $2}')
    if [[ $mem -lt 4000000 ]]; then
        warn "内存不足 4GB (当前: $((mem/1024/1024))GB)，OpenStack 可能无法正常运行"
        if [[ "$NODE_TYPE" == "controller" ]]; then
            warn "Controller 节点建议至少 8GB 内存"
        fi
    fi
    local disk_avail
    disk_avail=$(df /var --output=avail 2>/dev/null | tail -1)
    if [[ ${disk_avail:-0} -lt 20000000 ]]; then
        warn "/var 分区可用空间不足 20GB"
    fi
}

# 自动检测 ens33 的 IP
detect_ens33_ip() {
    local ip
    ip=$(ip -4 addr show ens33 2>/dev/null | grep -oP '(?<=inet\s)\d+(\.\d+){3}' | head -1)
    if [[ -z "$ip" ]]; then
        # fallback: 列所有 IP
        ip=$(ip -4 addr show | grep -oP '(?<=inet\s)\d+(\.\d+){3}' | grep -v '127.0.0.1' | head -1)
        if [[ -z "$ip" ]]; then
            error "无法检测到管理网卡 IP，请手动输入"
        fi
    fi
    echo "$ip"
}

# 自动检测可用的第二块网卡
detect_provider_iface() {
    local ifaces
    ifaces=$(ip -o link show | awk -F': ' '{print $2}' | grep -v 'lo\|docker\|veth\|br-\|virbr\|tun\|tap' | grep -v '^ens33$')
    echo "$ifaces" | head -1
}

# 自动扫描空闲磁盘给 Cinder LVM
detect_free_disk() {
    local disks d root_disk

    # 找到根文件系统所在的物理磁盘 (支持 LVM/分区/裸盘)
    local root_src
    root_src=$(findmnt -n -o SOURCE / 2>/dev/null)
    # 用 lsblk 向上追溯到物理磁盘 (PKNAME = parent kernel name)
    root_disk=$(lsblk -nd -o PKNAME "$root_src" 2>/dev/null | grep -v '^$')
    # 如果追溯结果为空(根直接在磁盘分区上), 直接提取磁盘名
    if [[ -z "$root_disk" ]]; then
        root_disk=$(lsblk -nd -o PKNAME "$(echo "$root_src" | sed 's|/dev/||; s/[0-9]*$//')" 2>/dev/null | grep -v '^$')
        [[ -z "$root_disk" ]] && root_disk=$(echo "$root_src" | sed 's|/dev/||; s/[0-9]*$//')
    fi

    # 找没有分区、未挂载的裸磁盘
    disks=$(lsblk -nd -o NAME,TYPE,MOUNTPOINT 2>/dev/null | awk '$2=="disk" {print $1}')
    for d in $disks; do
        # 排除根文件系统所在磁盘
        [[ "$d" == "$root_disk" ]] && continue
        # 排除磁盘本身被挂载的情况 (裸盘直接 mount)
        findmnt "/dev/$d" &>/dev/null && continue
        # 排除有分区被挂载的磁盘 (如 /dev/sdb2 → /boot)
        grep -q "/dev/${d}[0-9]" /proc/mounts 2>/dev/null && continue
        # 排除有分区作为 LVM PV 的磁盘 (如 /dev/sdb3 → openeuler VG)
        pvs --noheadings -o pv_name 2>/dev/null | grep -q "/dev/$d" && continue

        echo "/dev/$d"
        return 0
    done
    echo ""
}

# ─── 交互式配置 ─────────────────────────────────────────────────
interactive_config() {
    clear
    echo -e "${CYAN}"
    echo "╔══════════════════════════════════════════════════╗"
    echo "║      OpenStack Antelope 一键部署脚本             ║"
    echo "║      openEuler 24.03 LTS SP2                    ║"
    echo "║      双节点部署 (Controller + Compute)           ║"
    echo "╚══════════════════════════════════════════════════╝"
    echo -e "${NC}"

    # 1. 选择节点类型
    echo ""
    echo -e "${CYAN}请选择部署模式:${NC}"
    echo "  [1] Controller (控制节点，需手动到 Compute 上再次运行脚本)"
    echo "  [2] Compute    (计算节点)"
    echo "  [3] All-in-One (Controller 一键远程部署双节点)"
    while true; do
        read -rp "请输入 [1/2/3]: " node_choice
        case "$node_choice" in
            1) NODE_TYPE="controller"; break ;;
            2) NODE_TYPE="compute"; break ;;
            3) NODE_TYPE="controller"; DEPLOY_MODE="allinone"; break ;;
            *) echo "请输入 1, 2 或 3" ;;
        esac
    done
    save_state_var "NODE_TYPE" "$NODE_TYPE"
    [[ "$DEPLOY_MODE" == "allinone" ]] && save_state_var "DEPLOY_MODE" "allinone"
    echo ""

    # 2. 管理 IP
    local detected_ip
    detected_ip=$(detect_ens33_ip)
    if [[ -n "$detected_ip" ]]; then
        read -rp "检测到管理网卡 (ens33) IP: $detected_ip，是否使用? [Y/n]: " use_detected
        if [[ "$use_detected" =~ ^[Nn]$ ]]; then
            read -rp "请输入管理 IP: " MGMT_IP
        else
            MGMT_IP="$detected_ip"
        fi
    else
        read -rp "请输入管理 IP: " MGMT_IP
    fi
    save_state_var "MGMT_IP" "$MGMT_IP"
    echo ""

    # 3. Controller IP (Compute 节点需要) 或 Compute IP (Controller 需要)
    if [[ "$NODE_TYPE" == "compute" ]]; then
        local saved_ctrl_ip
        saved_ctrl_ip=$(get_state_var "CONTROLLER_IP")
        if [[ -n "$saved_ctrl_ip" ]]; then
            read -rp "Controller IP [$saved_ctrl_ip]: " ctrl_ip
            CONTROLLER_IP="${ctrl_ip:-$saved_ctrl_ip}"
        else
            read -rp "请输入 Controller 节点管理 IP: " CONTROLLER_IP
        fi
        save_state_var "CONTROLLER_IP" "$CONTROLLER_IP"
    else
        CONTROLLER_IP="$MGMT_IP"
        local saved_compute_ip
        saved_compute_ip=$(get_state_var "COMPUTE_IP")
        if [[ -n "$saved_compute_ip" ]]; then
            read -rp "Compute 节点 IP [$saved_compute_ip]: " cmpt_ip
            COMPUTE_IP="${cmpt_ip:-$saved_compute_ip}"
        elif [[ "$DEPLOY_MODE" == "allinone" ]]; then
            # all-in-one 模式: Compute IP 必填
            while [[ -z "$COMPUTE_IP" ]]; do
                read -rp "请输入 Compute 节点管理 IP (必填): " COMPUTE_IP
            done
        else
            read -rp "请输入 Compute 节点管理 IP (用于 Swift ring, 可稍后设置): " COMPUTE_IP
        fi
        save_state_var "COMPUTE_IP" "${COMPUTE_IP:-}"
    fi
    echo ""

    # 4. Provider 网卡
    local detected_provider
    detected_provider=$(detect_provider_iface)
    if [[ -n "$detected_provider" ]]; then
        read -rp "检测到 Provider 网卡: $detected_provider，是否使用? [Y/n]: " use_provider
        if [[ "$use_provider" =~ ^[Nn]$ ]]; then
            echo "可用网卡:"
            ip -o link show | awk -F': ' '{print "  " $2}' | grep -v 'lo\|docker\|veth\|br-\|virbr\|tun\|tap'
            read -rp "请输入 Provider 网卡名: " PROVIDER_IFACE
        else
            PROVIDER_IFACE="$detected_provider"
        fi
    else
        echo "可用网卡:"
        ip -o link show | awk -F': ' '{print "  " $2}' | grep -v 'lo\|docker\|veth\|br-\|virbr\|tun\|tap'
        read -rp "未检测到第二块网卡，请手动输入 Provider 网卡名: " PROVIDER_IFACE
    fi
    save_state_var "PROVIDER_IFACE" "$PROVIDER_IFACE"
    echo ""

    # 4b. 静态 IP 配置
    echo -e "${CYAN}管理网卡静态 IP 配置:${NC}"
    echo "  将当前 DHCP 获取的 IP 转为静态配置，避免重启后 IP 变动"
    read -rp "  是否启用? [Y/n]: " static_choice
    if [[ "$static_choice" =~ ^[Nn]$ ]]; then
        STATIC_IP_ENABLED="no"
        info "跳过静态 IP 配置，保持 DHCP"
    else
        STATIC_IP_ENABLED="yes"
        info "将配置静态 IP (网关为同网段 .2)"
    fi
    save_state_var "STATIC_IP_ENABLED" "$STATIC_IP_ENABLED"
    echo ""

    # 5. 密码配置
    echo -e "${CYAN}密码配置:${NC}"
    echo "  [1] 所有密码统一为 123456 (默认)"
    echo "  [2] 所有密码统一自定义"
    echo "  [3] 逐个服务单独设置 (高级)"
    while true; do
        read -rp "请选择 [1/2/3]: " pass_choice
        case "$pass_choice" in
            1)
                PASSWORD_MODE="default"
                info "使用默认密码 123456"
                break
                ;;
            2)
                PASSWORD_MODE="unified"
                read -rsp "请输入统一密码: " DEFAULT_PASS
                echo ""
                ;;
            3)
                PASSWORD_MODE="custom"
                info "逐项设置密码 (回车使用默认值 123456):"
                read -rsp "  Admin 密码: " ADMIN_PASS; ADMIN_PASS="${ADMIN_PASS:-$DEFAULT_PASS}"; echo ""
                read -rsp "  RabbitMQ 密码: " RABBIT_PASS; RABBIT_PASS="${RABBIT_PASS:-$DEFAULT_PASS}"; echo ""
                read -rsp "  Keystone DB 密码: " KEYSTONE_DBPASS; KEYSTONE_DBPASS="${KEYSTONE_DBPASS:-$DEFAULT_PASS}"; echo ""
                read -rsp "  Glance 密码: " GLANCE_PASS; GLANCE_PASS="${GLANCE_PASS:-$DEFAULT_PASS}"; echo ""
                read -rsp "  Glance DB 密码: " GLANCE_DBPASS; GLANCE_DBPASS="${GLANCE_DBPASS:-$DEFAULT_PASS}"; echo ""
                read -rsp "  Placement 密码: " PLACEMENT_PASS; PLACEMENT_PASS="${PLACEMENT_PASS:-$DEFAULT_PASS}"; echo ""
                read -rsp "  Placement DB 密码: " PLACEMENT_DBPASS; PLACEMENT_DBPASS="${PLACEMENT_DBPASS:-$DEFAULT_PASS}"; echo ""
                read -rsp "  Nova 密码: " NOVA_PASS; NOVA_PASS="${NOVA_PASS:-$DEFAULT_PASS}"; echo ""
                read -rsp "  Nova DB 密码: " NOVA_DBPASS; NOVA_DBPASS="${NOVA_DBPASS:-$DEFAULT_PASS}"; echo ""
                read -rsp "  Neutron 密码: " NEUTRON_PASS; NEUTRON_PASS="${NEUTRON_PASS:-$DEFAULT_PASS}"; echo ""
                read -rsp "  Neutron DB 密码: " NEUTRON_DBPASS; NEUTRON_DBPASS="${NEUTRON_DBPASS:-$DEFAULT_PASS}"; echo ""
                read -rsp "  Cinder 密码: " CINDER_PASS; CINDER_PASS="${CINDER_PASS:-$DEFAULT_PASS}"; echo ""
                read -rsp "  Cinder DB 密码: " CINDER_DBPASS; CINDER_DBPASS="${CINDER_DBPASS:-$DEFAULT_PASS}"; echo ""
                read -rsp "  Swift 密码: " SWIFT_PASS; SWIFT_PASS="${SWIFT_PASS:-$DEFAULT_PASS}"; echo ""
                read -rsp "  Metadata Secret: " METADATA_SECRET; METADATA_SECRET="${METADATA_SECRET:-$DEFAULT_PASS}"; echo ""
                break
                ;;
            *)
                echo "请输入 1, 2 或 3"
                ;;
        esac
    done

    # 如果选择了统一模式，设置所有密码
    if [[ "$PASSWORD_MODE" == "unified" ]]; then
        ADMIN_PASS="$DEFAULT_PASS"
        RABBIT_PASS="$DEFAULT_PASS"
        KEYSTONE_DBPASS="$DEFAULT_PASS"
        GLANCE_PASS="$DEFAULT_PASS"; GLANCE_DBPASS="$DEFAULT_PASS"
        PLACEMENT_PASS="$DEFAULT_PASS"; PLACEMENT_DBPASS="$DEFAULT_PASS"
        NOVA_PASS="$DEFAULT_PASS"; NOVA_DBPASS="$DEFAULT_PASS"
        NEUTRON_PASS="$DEFAULT_PASS"; NEUTRON_DBPASS="$DEFAULT_PASS"
        CINDER_PASS="$DEFAULT_PASS"; CINDER_DBPASS="$DEFAULT_PASS"
        SWIFT_PASS="$DEFAULT_PASS"
        METADATA_SECRET="$DEFAULT_PASS"
    fi
    save_state_var "PASSWORD_MODE" "$PASSWORD_MODE"
    echo ""

    # 5b. All-in-One: Compute 节点远程部署配置
    if [[ "$DEPLOY_MODE" == "allinone" ]]; then
        echo -e "${CYAN}═══ Compute 节点配置 (远程部署) ═══${NC}"

        # Compute Provider 网卡
        echo ""
        echo "可用的 Compute 网卡参考 (本机探测, 请确认 Compute 上对应网卡名):"
        ip -o link show | awk -F': ' '{print "  " $2}' | grep -v 'lo\|docker\|veth\|br-\|virbr\|tun\|tap'
        read -rp "Compute 节点 Provider 网卡名: " COMPUTE_PROVIDER_IFACE
        save_state_var "COMPUTE_PROVIDER_IFACE" "$COMPUTE_PROVIDER_IFACE"

        # Compute root 密码
        while true; do
            read -rsp "Compute 节点 root 密码: " COMPUTE_ROOT_PASS
            echo ""
            if [[ -z "$COMPUTE_ROOT_PASS" ]]; then
                error "All-in-One 模式必须提供 Compute root 密码"
            fi

            # 明文确认
            read -rp "是否显示密码以确认输入正确? [y/N]: " show_pass
            if [[ "$show_pass" =~ ^[Yy]$ ]]; then
                echo -e "  密码明文: ${YELLOW}${COMPUTE_ROOT_PASS}${NC}"
            fi

            # SSH 验证密码
            info "验证 Compute 连接 (root@$COMPUTE_IP)..."
            if ! command -v sshpass &>/dev/null; then
                dnf install -y sshpass 2>/dev/null || true
            fi
            if command -v sshpass &>/dev/null; then
                if sshpass -p "$COMPUTE_ROOT_PASS" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 \
                    "root@$COMPUTE_IP" "echo ok" 2>/dev/null; then
                    success "Compute 密码验证通过"
                    break
                else
                    warn "无法连接到 Compute ($COMPUTE_IP)，请检查 IP 和密码"
                    read -rp "是否重新输入密码? [Y/n]: " retry
                    if [[ "$retry" =~ ^[Nn]$ ]]; then
                        warn "跳过验证，远程部署阶段可能失败"
                        break
                    fi
                fi
            else
                warn "无法安装 sshpass，跳过密码验证"
                break
            fi
        done
        info "Compute root 密码已记录 (仅内存, 不落盘)"

        # Compute Cinder 磁盘 (可选，留空则部署时自动检测)
        read -rp "Compute 节点 Cinder LVM 磁盘 (如 /dev/sdb, 回车=自动检测): " REMOTE_CINDER_DISK
        if [[ -n "$REMOTE_CINDER_DISK" ]]; then
            info "Compute Cinder 磁盘: $REMOTE_CINDER_DISK"
        else
            info "未指定，Compute 部署时将自动检测空闲磁盘"
        fi

        # Compute 静态 IP
        read -rp "Compute 节点是否配置静态 IP? [Y/n]: " cmpt_static
        if [[ "$cmpt_static" =~ ^[Nn]$ ]]; then
            COMPUTE_STATIC_IP_ENABLED="no"
            info "Compute 跳过静态 IP 配置，保持 DHCP"
        else
            COMPUTE_STATIC_IP_ENABLED="yes"
            info "Compute 将配置静态 IP (网关为同网段 .2)"
        fi
        save_state_var "COMPUTE_STATIC_IP_ENABLED" "$COMPUTE_STATIC_IP_ENABLED"
        echo ""
    fi

    # 6. Compute 节点: 扫描 Cinder 磁盘
    if [[ "$NODE_TYPE" == "compute" ]]; then
        CINDER_DISK=$(detect_free_disk)
        if [[ -n "$CINDER_DISK" ]]; then
            read -rp "检测到空闲磁盘: $CINDER_DISK，用作 Cinder LVM 后端? [Y/n]: " use_disk
            if [[ "$use_disk" =~ ^[Nn]$ ]]; then
                read -rp "请输入 Cinder 磁盘路径 (如 /dev/sdc，回车跳过): " CINDER_DISK
            fi
        else
            warn "未检测到空闲磁盘"
            info "当前磁盘布局:"
            lsblk -o NAME,TYPE,SIZE,MOUNTPOINT 2>/dev/null || true
            read -rp "请手动输入 Cinder 磁盘路径 (如 /dev/sdc，回车跳过，部署时自动检测): " CINDER_DISK
        fi
        save_state_var "CINDER_DISK" "${CINDER_DISK:-}"
        echo ""
    fi

    # 7. Compute: SSH 自动验证 (可选)
    if [[ "$NODE_TYPE" == "compute" ]]; then
        echo ""
        echo -e "${CYAN}自动验证配置 (可选):${NC}"
        echo "  输入 Controller root 密码可在部署完成后自动验证节点注册状态"
        read -rsp "  Controller root 密码 (回车跳过): " CTRL_ROOT_PASS
        echo ""
        if [[ -n "$CTRL_ROOT_PASS" ]]; then
            info "将在部署完成后自动 SSH 到 Controller 执行节点发现与验证"
        else
            info "跳过自动验证，部署完成后需手动到 Controller 执行 discover_hosts"
        fi
    fi

    # 8. 显示摘要并确认
    echo -e "${CYAN}╔══════════════════════════════════════════════════╗${NC}"
    echo -e "${CYAN}║              部署配置摘要                         ║${NC}"
    echo -e "${CYAN}╠══════════════════════════════════════════════════╣${NC}"
    echo -e "${CYAN}║${NC} 部署模式:    ${GREEN}$([[ "$DEPLOY_MODE" == "allinone" ]] && echo "All-in-One (双节点)" || echo "$NODE_TYPE")${NC}"
    echo -e "${CYAN}║${NC} 管理 IP:     ${GREEN}$MGMT_IP${NC}"
    [[ "$NODE_TYPE" == "compute" ]] && echo -e "${CYAN}║${NC} Controller:  ${GREEN}$CONTROLLER_IP${NC}"
    [[ "$DEPLOY_MODE" == "allinone" ]] && echo -e "${CYAN}║${NC} Compute IP:  ${GREEN}$COMPUTE_IP${NC}"
    echo -e "${CYAN}║${NC} Provider 网卡: ${GREEN}$PROVIDER_IFACE${NC}"
    [[ "$DEPLOY_MODE" == "allinone" ]] && echo -e "${CYAN}║${NC} Compute Prov: ${GREEN}$COMPUTE_PROVIDER_IFACE${NC}"
    echo -e "${CYAN}║${NC} 密码模式:    ${GREEN}$PASSWORD_MODE${NC}"
    [[ "$NODE_TYPE" == "compute" && -n "$CINDER_DISK" ]] && echo -e "${CYAN}║${NC} Cinder 磁盘: ${GREEN}$CINDER_DISK${NC}"
    [[ "$NODE_TYPE" == "compute" && -z "$CINDER_DISK" ]] && echo -e "${CYAN}║${NC} Cinder 磁盘: ${YELLOW}跳过${NC}"
    echo -e "${CYAN}╚══════════════════════════════════════════════════╝${NC}"
    read -rp "确认开始部署? [Y/n]: " confirm
    if [[ "$confirm" =~ ^[Nn]$ ]]; then
        info "用户取消部署"
        exit 0
    fi
}

# ─── init 阶段 ─────────────────────────────────────────────────
stage_init() {
    mkdir -p "$LOG_DIR" "$BACKUP_DIR"
    info "日志文件: $LOG_FILE"
    info "配置备份: $BACKUP_DIR"
    check_os
}

# ╔══════════════════════════════════════════════════════════════╗
# ║              Controller 阶段                                ║
# ╚══════════════════════════════════════════════════════════════╝

# ─── C1: 环境准备 ──────────────────────────────────────────────
stage_env_prep_ctrl() {
    skip_if_done "env_prep" && return
    step "C1: Controller 环境准备"

    info "关闭 SELinux..."
    setenforce 0 || true
    sed -i 's/^SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config
    success "SELinux → disabled"

    info "关闭 firewalld..."
    systemctl stop firewalld 2>/dev/null || true
    systemctl disable firewalld 2>/dev/null || true
    success "firewalld → disabled"

    info "设置主机名..."
    hostnamectl set-hostname controller
    echo "controller" > /etc/hostname
    success "主机名: controller"

    info "配置 /etc/hosts..."
    grep -q "controller" /etc/hosts 2>/dev/null || \
        echo "$MGMT_IP   controller" >> /etc/hosts
    success "/etc/hosts 已更新"

    # 配置静态 IP (防止 DHCP 租约过期后 IP 变动)
    if [[ "$STATIC_IP_ENABLED" != "no" ]]; then
        local mgmt_iface
        mgmt_iface=$(detect_mgmt_iface "$MGMT_IP")
        if [[ -n "$mgmt_iface" ]]; then
            set_static_ip "$mgmt_iface" "$MGMT_IP" || warn "静态 IP 配置失败，请手动设置"
        else
            warn "无法检测管理网卡，跳过静态 IP 配置"
        fi
    else
        info "已跳过静态 IP 配置 (用户选择保持 DHCP)"
    fi

    info "配置 YUM 源..."
    if ! rpm -q openstack-release-antelope &>/dev/null; then
        warn "yum update 可能需要 10-30 分钟，请耐心等待..."
        run_verbose "系统包更新 (yum update)" yum update -y
        wait_dnf 60
        run_verbose "安装 OpenStack Release 包" yum install -y openstack-release-antelope
    fi
    # 确保 EPOL 启用
    if ! grep -q '^\[EPOL\]' /etc/yum.repos.d/openEuler.repo 2>/dev/null; then
        cat >> /etc/yum.repos.d/openEuler.repo << 'EOF'
[EPOL]
name=EPOL
baseurl=http://repo.openeuler.org/openEuler-24.03-LTS-SP2/EPOL/main/$basearch/
enabled=1
gpgcheck=1
gpgkey=http://repo.openeuler.org/openEuler-24.03-LTS-SP2/OS/$basearch/RPM-GPG-KEY-openEuler
EOF
    fi
    run_verbose "刷新 YUM 缓存" bash -c "yum clean all && yum makecache"
    success "YUM 源配置完成"

    # 生成 SSH 密钥对(供 Compute ssh-copy-id 及双向互信)
    if [[ ! -f ~/.ssh/id_rsa ]]; then
        ssh-keygen -t rsa -b 4096 -f ~/.ssh/id_rsa -N "" -q
        success "SSH 密钥对已生成"
    fi
    save_state_var "CTRL_HOSTKEY" "$(cat ~/.ssh/id_rsa.pub 2>/dev/null || echo '')"

    mark_stage "env_prep"
}

# ─── C2: 基础服务 (Chrony, MariaDB, RabbitMQ, Memcached) ───────
stage_base_services_ctrl() {
    skip_if_done "base_services" && return
    step "C2: 基础服务 (Chrony, MariaDB, RabbitMQ, Memcached)"

    # Chrony (NTP Server)
    info "安装 Chrony..."
    dnf install -y chrony >> "$LOG_FILE" 2>&1
    sed -i '/^allow /d' /etc/chrony.conf
    # 计算网段: 192.168.0.2 → 192.168.0.0/24
    local subnet
    subnet=$(echo "$MGMT_IP" | sed 's/\.[0-9]*$/.0\/24/')
    echo "allow $subnet" >> /etc/chrony.conf
    systemctl restart chronyd
    systemctl enable chronyd
    success "Chrony NTP Server 已配置"

    # MariaDB
    info "安装 MariaDB..."
    run_verbose "安装 MariaDB" dnf install -y mariadb-config mariadb mariadb-server python3-PyMySQL
    cat > /etc/my.cnf.d/openstack.cnf << EOF
[mysqld]
bind-address = $MGMT_IP
default-storage-engine = innodb
innodb_file_per_table = on
max_connections = 4096
collation-server = utf8_general_ci
character-set-server = utf8
EOF
    systemctl restart mariadb
    systemctl enable mariadb
    # 如果 mysql_secure_installation 还没执行过
    if ! mysql -uroot -p"$DEFAULT_PASS" -e "SELECT 1" &>/dev/null; then
        info "初始化 MariaDB..."
        # 先尝试无密码连接
        if mysql -uroot -e "SELECT 1" &>/dev/null; then
            mysql -uroot <<SQL
ALTER USER 'root'@'localhost' IDENTIFIED BY '$DEFAULT_PASS';
DELETE FROM mysql.user WHERE User='';
DELETE FROM mysql.user WHERE User='root' AND Host NOT IN ('localhost', '127.0.0.1', '::1');
DROP DATABASE IF EXISTS test;
DELETE FROM mysql.db WHERE Db='test' OR Db='test\\_%';
FLUSH PRIVILEGES;
SQL
        fi
    fi
    success "MariaDB 已配置 (root 密码: $DEFAULT_PASS)"

    # RabbitMQ
    info "安装 RabbitMQ..."
    dnf install -y rabbitmq-server >> "$LOG_FILE" 2>&1
    systemctl restart rabbitmq-server
    systemctl enable rabbitmq-server
    # 创建 openstack 用户
    if ! rabbitmqctl list_users 2>/dev/null | grep -q openstack; then
        rabbitmqctl add_user openstack "$RABBIT_PASS"
        rabbitmqctl set_permissions openstack ".*" ".*" ".*"
        success "RabbitMQ openstack 用户已创建"
    else
        rabbitmqctl change_password openstack "$RABBIT_PASS" 2>/dev/null || true
        success "RabbitMQ openstack 用户已存在，密码已更新"
    fi

    # Memcached
    info "安装 Memcached..."
    dnf install -y memcached python3-memcached >> "$LOG_FILE" 2>&1
    sed -i 's/^OPTIONS=.*/OPTIONS="-l 127.0.0.1,::1,controller"/' /etc/sysconfig/memcached
    systemctl restart memcached
    systemctl enable memcached
    success "Memcached 已配置"

    mark_stage "base_services"
}

# ─── C3: Keystone ──────────────────────────────────────────────
stage_keystone_ctrl() {
    skip_if_done "keystone" && return
    step "C3: Keystone 认证服务"

    # 创建数据库
    info "创建 keystone 数据库..."
    mysql -uroot -p"$DEFAULT_PASS" <<SQL
CREATE DATABASE IF NOT EXISTS keystone;
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'localhost' IDENTIFIED BY '$KEYSTONE_DBPASS';
GRANT ALL PRIVILEGES ON keystone.* TO 'keystone'@'%' IDENTIFIED BY '$KEYSTONE_DBPASS';
FLUSH PRIVILEGES;
SQL
    success "Keystone 数据库已创建"

    # 安装软件包
    info "安装 Keystone..."
    run_verbose "安装 Keystone" dnf install -y openstack-keystone httpd mod_wsgi python3-openstackclient

    # 配置 keystone.conf
    cat > /etc/keystone/keystone.conf << EOF
[database]
connection = mysql+pymysql://keystone:$KEYSTONE_DBPASS@controller/keystone

[token]
provider = fernet
EOF
    success "keystone.conf 已配置"

    # 同步数据库
    info "同步数据库..."
    su -s /bin/sh -c "keystone-manage db_sync" keystone

    # 初始化 Fernet
    keystone-manage fernet_setup --keystone-user keystone --keystone-group keystone
    keystone-manage credential_setup --keystone-user keystone --keystone-group keystone

    # Bootstrap
    info "初始化 Keystone..."
    keystone-manage bootstrap --bootstrap-password "$ADMIN_PASS" \
        --bootstrap-admin-url "http://controller:5000/v3/" \
        --bootstrap-internal-url "http://controller:5000/v3/" \
        --bootstrap-public-url "http://controller:5000/v3/" \
        --bootstrap-region-id RegionOne

    # Apache 配置
    sed -i '/^ServerName/d' /etc/httpd/conf/httpd.conf 2>/dev/null
    echo "ServerName controller" >> /etc/httpd/conf/httpd.conf
    ln -sf /usr/share/keystone/wsgi-keystone.conf /etc/httpd/conf.d/
    systemctl restart httpd
    systemctl enable httpd

    # 创建 admin-openrc
    cat > ~/admin-openrc << EOF
export OS_PROJECT_DOMAIN_NAME=Default
export OS_USER_DOMAIN_NAME=Default
export OS_PROJECT_NAME=admin
export OS_USERNAME=admin
export OS_PASSWORD=$ADMIN_PASS
export OS_AUTH_URL=http://controller:5000/v3
export OS_IDENTITY_API_VERSION=3
export OS_IMAGE_API_VERSION=2
EOF
    source ~/admin-openrc

    # 创建 service project 和 demo 资源
    info "创建 Keystone 资源..."
    openstack domain create --description "An Example Domain" example 2>/dev/null || true
    openstack project create --domain default --description "Service Project" service 2>/dev/null || true
    openstack project create --domain default --description "Demo Project" myproject 2>/dev/null || true
    openstack user create --domain default --password "$ADMIN_PASS" myuser 2>/dev/null || true
    openstack role create myrole 2>/dev/null || true
    openstack role add --project myproject --user myuser myrole 2>/dev/null || true

    # 验证
    info "验证 Keystone..."
    unset OS_AUTH_URL OS_PASSWORD
    openstack --os-auth-url http://controller:5000/v3 \
        --os-project-domain-name Default --os-user-domain-name Default \
        --os-project-name admin --os-username admin token issue --os-password "$ADMIN_PASS" > /dev/null
    source ~/admin-openrc
    success "Keystone 验证通过"

    mark_stage "keystone"
}

# ─── C4: Glance ────────────────────────────────────────────────
stage_glance_ctrl() {
    skip_if_done "glance" && return
    step "C4: Glance 镜像服务"

    mysql -uroot -p"$DEFAULT_PASS" <<SQL
CREATE DATABASE IF NOT EXISTS glance;
GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'localhost' IDENTIFIED BY '$GLANCE_DBPASS';
GRANT ALL PRIVILEGES ON glance.* TO 'glance'@'%' IDENTIFIED BY '$GLANCE_DBPASS';
FLUSH PRIVILEGES;
SQL

    source ~/admin-openrc
    openstack user list 2>/dev/null | grep -q glance || openstack user create --domain default --password "$GLANCE_PASS" glance
    openstack role add --project service --user glance admin 2>/dev/null || true
    openstack service list 2>/dev/null | grep -q glance || openstack service create --name glance --description "OpenStack Image" image
    openstack endpoint list 2>/dev/null | grep -q image || {
        openstack endpoint create --region RegionOne image public http://controller:9292
        openstack endpoint create --region RegionOne image internal http://controller:9292
        openstack endpoint create --region RegionOne image admin http://controller:9292
    }

    run_verbose "安装 Glance" dnf install -y openstack-glance

    cat > /etc/glance/glance-api.conf << EOF
[database]
connection = mysql+pymysql://glance:$GLANCE_DBPASS@controller/glance

[keystone_authtoken]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = glance
password = $GLANCE_PASS

[paste_deploy]
flavor = keystone

[glance_store]
stores = file,http
default_store = file
filesystem_store_datadir = /var/lib/glance/images/
EOF

    su -s /bin/sh -c "glance-manage db_sync" glance

    systemctl enable openstack-glance-api.service
    systemctl restart openstack-glance-api.service

    # 等待 glance-api 就绪
    info "等待 Glance API 就绪..."
    wait_port controller 9292 30

    # 下载并上传测试镜像 (跳过: 可在 Horizon Web 自行上传)
    info "cirros 测试镜像下载已跳过 (可在 Horizon Web 界面手动上传)"

    openstack image list
    success "Glance 部署完成"

    mark_stage "glance"
}

# ─── C5: Placement ─────────────────────────────────────────────
stage_placement_ctrl() {
    skip_if_done "placement" && return
    step "C5: Placement 资源调度"

    mysql -uroot -p"$DEFAULT_PASS" <<SQL
CREATE DATABASE IF NOT EXISTS placement;
GRANT ALL PRIVILEGES ON placement.* TO 'placement'@'localhost' IDENTIFIED BY '$PLACEMENT_DBPASS';
GRANT ALL PRIVILEGES ON placement.* TO 'placement'@'%' IDENTIFIED BY '$PLACEMENT_DBPASS';
FLUSH PRIVILEGES;
SQL

    source ~/admin-openrc
    openstack user list 2>/dev/null | grep -q placement || openstack user create --domain default --password "$PLACEMENT_PASS" placement
    openstack role add --project service --user placement admin 2>/dev/null || true
    openstack service list 2>/dev/null | grep -q placement || openstack service create --name placement --description "Placement API" placement
    openstack endpoint list 2>/dev/null | grep -q placement || {
        openstack endpoint create --region RegionOne placement public http://controller:8778
        openstack endpoint create --region RegionOne placement internal http://controller:8778
        openstack endpoint create --region RegionOne placement admin http://controller:8778
    }

    run_verbose "安装 Placement API" dnf install -y openstack-placement-api

    cat > /etc/placement/placement.conf << EOF
[placement_database]
connection = mysql+pymysql://placement:$PLACEMENT_DBPASS@controller/placement

[api]
auth_strategy = keystone

[keystone_authtoken]
auth_url = http://controller:5000/v3
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = placement
password = $PLACEMENT_PASS
EOF

    su -s /bin/sh -c "placement-manage db sync" placement
    systemctl restart httpd

    # 验证
    dnf install -y python3-osc-placement >> "$LOG_FILE" 2>&1
    source ~/admin-openrc
    openstack --os-placement-api-version 1.2 resource class list --sort-column name > /dev/null
    success "Placement 部署完成"

    mark_stage "placement"
}

# ─── C6: Nova (Controller) ─────────────────────────────────────
stage_nova_ctrl() {
    skip_if_done "nova_ctrl" && return
    step "C6: Nova 计算服务 (Controller)"

    mysql -uroot -p"$DEFAULT_PASS" <<SQL
CREATE DATABASE IF NOT EXISTS nova_api;
CREATE DATABASE IF NOT EXISTS nova;
CREATE DATABASE IF NOT EXISTS nova_cell0;
GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'localhost' IDENTIFIED BY '$NOVA_DBPASS';
GRANT ALL PRIVILEGES ON nova_api.* TO 'nova'@'%' IDENTIFIED BY '$NOVA_DBPASS';
GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'localhost' IDENTIFIED BY '$NOVA_DBPASS';
GRANT ALL PRIVILEGES ON nova.* TO 'nova'@'%' IDENTIFIED BY '$NOVA_DBPASS';
GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'localhost' IDENTIFIED BY '$NOVA_DBPASS';
GRANT ALL PRIVILEGES ON nova_cell0.* TO 'nova'@'%' IDENTIFIED BY '$NOVA_DBPASS';
FLUSH PRIVILEGES;
SQL

    source ~/admin-openrc
    openstack user list 2>/dev/null | grep -q nova || openstack user create --domain default --password "$NOVA_PASS" nova
    openstack role add --project service --user nova admin 2>/dev/null || true
    openstack service list 2>/dev/null | grep -q nova || openstack service create --name nova --description "OpenStack Compute" compute
    openstack endpoint list 2>/dev/null | grep -q compute || {
        openstack endpoint create --region RegionOne compute public "http://controller:8774/v2.1"
        openstack endpoint create --region RegionOne compute internal "http://controller:8774/v2.1"
        openstack endpoint create --region RegionOne compute admin "http://controller:8774/v2.1"
    }

    run_verbose "安装 Nova 控制服务" dnf install -y openstack-nova-api openstack-nova-conductor \
        openstack-nova-novncproxy openstack-nova-scheduler

    cat > /etc/nova/nova.conf << EOF
[DEFAULT]
enabled_apis = osapi_compute,metadata
transport_url = rabbit://openstack:$RABBIT_PASS@controller:5672/
my_ip = $MGMT_IP
log_dir = /var/log/nova
state_path = /var/lib/nova

[api_database]
connection = mysql+pymysql://nova:$NOVA_DBPASS@controller/nova_api

[database]
connection = mysql+pymysql://nova:$NOVA_DBPASS@controller/nova

[api]
auth_strategy = keystone

[keystone_authtoken]
auth_url = http://controller:5000/v3
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = nova
password = $NOVA_PASS

[vnc]
enabled = true
server_listen = \$my_ip
server_proxyclient_address = \$my_ip

[glance]
api_servers = http://controller:9292

[oslo_concurrency]
lock_path = /var/lib/nova/tmp

[placement]
region_name = RegionOne
project_domain_name = Default
project_name = service
auth_type = password
user_domain_name = Default
auth_url = http://controller:5000/v3
username = placement
password = $PLACEMENT_PASS
EOF

    su -s /bin/sh -c "nova-manage api_db sync" nova
    su -s /bin/sh -c "nova-manage cell_v2 map_cell0" nova
    su -s /bin/sh -c "nova-manage cell_v2 create_cell --name=cell1 --verbose" nova
    su -s /bin/sh -c "nova-manage db sync" nova
    su -s /bin/sh -c "nova-manage cell_v2 list_cells" nova

    systemctl enable openstack-nova-api.service openstack-nova-scheduler.service \
        openstack-nova-conductor.service openstack-nova-novncproxy.service
    systemctl restart openstack-nova-api.service openstack-nova-scheduler.service \
        openstack-nova-conductor.service openstack-nova-novncproxy.service

    source ~/admin-openrc
    openstack compute service list

    success "Nova Controller 部署完成"
    mark_stage "nova_ctrl"
}

# ─── C7: Neutron (Controller) ──────────────────────────────────
stage_neutron_ctrl() {
    skip_if_done "neutron_ctrl" && return
    step "C7: Neutron 网络服务 (Controller)"

    mysql -uroot -p"$DEFAULT_PASS" <<SQL
CREATE DATABASE IF NOT EXISTS neutron;
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'localhost' IDENTIFIED BY '$NEUTRON_DBPASS';
GRANT ALL PRIVILEGES ON neutron.* TO 'neutron'@'%' IDENTIFIED BY '$NEUTRON_DBPASS';
FLUSH PRIVILEGES;
SQL

    source ~/admin-openrc
    openstack user list 2>/dev/null | grep -q neutron || openstack user create --domain default --password "$NEUTRON_PASS" neutron
    openstack role add --project service --user neutron admin 2>/dev/null || true
    openstack service list 2>/dev/null | grep -q neutron || openstack service create --name neutron --description "OpenStack Networking" network
    openstack endpoint list 2>/dev/null | grep -q network || {
        openstack endpoint create --region RegionOne network public http://controller:9696
        openstack endpoint create --region RegionOne network internal http://controller:9696
        openstack endpoint create --region RegionOne network admin http://controller:9696
    }

    run_verbose "安装 Neutron 网络服务" dnf install -y openstack-neutron openstack-neutron-linuxbridge \
        ebtables ipset openstack-neutron-ml2

    # neutron.conf
    cat > /etc/neutron/neutron.conf << EOF
[DEFAULT]
core_plugin = ml2
service_plugins = router
allow_overlapping_ips = true
transport_url = rabbit://openstack:$RABBIT_PASS@controller
auth_strategy = keystone
notify_nova_on_port_status_changes = true
notify_nova_on_port_data_changes = true

[database]
connection = mysql+pymysql://neutron:$NEUTRON_DBPASS@controller/neutron

[keystone_authtoken]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = neutron
password = $NEUTRON_PASS

[nova]
auth_url = http://controller:5000
auth_type = password
project_domain_name = Default
user_domain_name = Default
region_name = RegionOne
project_name = service
username = nova
password = $NOVA_PASS

[oslo_concurrency]
lock_path = /var/lib/neutron/tmp

[experimental]
linuxbridge = true
EOF

    # ml2_conf.ini
    cat > /etc/neutron/plugins/ml2/ml2_conf.ini << EOF
[ml2]
type_drivers = flat,vlan,vxlan
tenant_network_types = vxlan
mechanism_drivers = linuxbridge,l2population
extension_drivers = port_security

[ml2_type_flat]
flat_networks = provider

[ml2_type_vxlan]
vni_ranges = 1:1000

[securitygroup]
enable_ipset = true
EOF

    # linuxbridge_agent.ini
    cat > /etc/neutron/plugins/ml2/linuxbridge_agent.ini << EOF
[linux_bridge]
physical_interface_mappings = provider:$PROVIDER_IFACE

[vxlan]
enable_vxlan = true
local_ip = $MGMT_IP
l2_population = true

[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
EOF

    # l3_agent.ini
    cat > /etc/neutron/l3_agent.ini << EOF
[DEFAULT]
interface_driver = linuxbridge
EOF

    # dhcp_agent.ini
    cat > /etc/neutron/dhcp_agent.ini << EOF
[DEFAULT]
interface_driver = linuxbridge
dhcp_driver = neutron.agent.linux.dhcp.Dnsmasq
enable_isolated_metadata = true
EOF

    # metadata_agent.ini
    cat > /etc/neutron/metadata_agent.ini << EOF
[DEFAULT]
nova_metadata_host = controller
metadata_proxy_shared_secret = $METADATA_SECRET
EOF

    # 追加 Neutron 配置到 nova.conf
    cat >> /etc/nova/nova.conf << EOF

[neutron]
auth_url = http://controller:5000
auth_type = password
project_domain_name = Default
user_domain_name = Default
region_name = RegionOne
project_name = service
username = neutron
password = $NEUTRON_PASS
service_metadata_proxy = true
metadata_proxy_shared_secret = $METADATA_SECRET
EOF

    ln -sf /etc/neutron/plugins/ml2/ml2_conf.ini /etc/neutron/plugin.ini

    su -s /bin/sh -c "neutron-db-manage --config-file /etc/neutron/neutron.conf \
        --config-file /etc/neutron/plugins/ml2/ml2_conf.ini upgrade head" neutron

    systemctl restart openstack-nova-api

    systemctl enable neutron-server.service neutron-linuxbridge-agent.service \
        neutron-dhcp-agent.service neutron-metadata-agent.service neutron-l3-agent.service
    systemctl restart neutron-server.service neutron-linuxbridge-agent.service \
        neutron-dhcp-agent.service neutron-metadata-agent.service neutron-l3-agent.service

    info "等待 Neutron API 就绪..."
    wait_port controller 9696 30

    source ~/admin-openrc
    openstack network agent list

    success "Neutron Controller 部署完成"
    mark_stage "neutron_ctrl"
}

# ─── C8: Cinder (Controller) ──────────────────────────────────
stage_cinder_ctrl() {
    skip_if_done "cinder_ctrl" && return
    step "C8: Cinder 块存储 (Controller)"

    mysql -uroot -p"$DEFAULT_PASS" <<SQL
CREATE DATABASE IF NOT EXISTS cinder;
GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'localhost' IDENTIFIED BY '$CINDER_DBPASS';
GRANT ALL PRIVILEGES ON cinder.* TO 'cinder'@'%' IDENTIFIED BY '$CINDER_DBPASS';
FLUSH PRIVILEGES;
SQL

    source ~/admin-openrc
    openstack user list 2>/dev/null | grep -q cinder || openstack user create --domain default --password "$CINDER_PASS" cinder
    openstack role add --project service --user cinder admin 2>/dev/null || true
    openstack service list 2>/dev/null | grep -q cinderv3 || openstack service create --name cinderv3 --description "OpenStack Block Storage" volumev3
    openstack endpoint list 2>/dev/null | grep -q volumev3 || {
        openstack endpoint create --region RegionOne volumev3 public "http://controller:8776/v3/%(project_id)s"
        openstack endpoint create --region RegionOne volumev3 internal "http://controller:8776/v3/%(project_id)s"
        openstack endpoint create --region RegionOne volumev3 admin "http://controller:8776/v3/%(project_id)s"
    }

    run_verbose "安装 Cinder 控制服务" dnf install -y openstack-cinder-api openstack-cinder-scheduler

    cat > /etc/cinder/cinder.conf << EOF
[DEFAULT]
transport_url = rabbit://openstack:$RABBIT_PASS@controller
auth_strategy = keystone
my_ip = $MGMT_IP

[database]
connection = mysql+pymysql://cinder:$CINDER_DBPASS@controller/cinder

[keystone_authtoken]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = cinder
password = $CINDER_PASS

[glance]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = cinder
password = $CINDER_PASS
region_name = RegionOne

[oslo_concurrency]
lock_path = /var/lib/cinder/tmp
EOF

    # 追加 Cinder 配置到 nova.conf
    cat >> /etc/nova/nova.conf << EOF

[cinder]
os_region_name = RegionOne
EOF

    su -s /bin/sh -c "cinder-manage db sync" cinder

    systemctl restart openstack-nova-api
    systemctl enable openstack-cinder-api openstack-cinder-scheduler
    systemctl restart openstack-cinder-api openstack-cinder-scheduler

    info "等待 Cinder API 就绪..."
    wait_port controller 8776 30

    source ~/admin-openrc
    openstack volume service list

    success "Cinder Controller 部署完成"
    mark_stage "cinder_ctrl"
}

# ─── C9: Swift (Controller) ────────────────────────────────────
stage_swift_ctrl() {
    skip_if_done "swift_ctrl" && return
    step "C9: Swift 对象存储 (Controller)"

    source ~/admin-openrc
    openstack user list 2>/dev/null | grep -q swift || openstack user create --domain default --password "$SWIFT_PASS" swift
    openstack role add --project service --user swift admin 2>/dev/null || true
    openstack service list 2>/dev/null | grep -q swift || openstack service create --name swift --description "OpenStack Object Storage" object-store
    openstack endpoint list 2>/dev/null | grep -q object-store || {
        openstack endpoint create --region RegionOne object-store public "http://controller:8080/v1/AUTH_%(project_id)s"
        openstack endpoint create --region RegionOne object-store internal "http://controller:8080/v1/AUTH_%(project_id)s"
        openstack endpoint create --region RegionOne object-store admin "http://controller:8080/v1"
    }

    run_verbose "安装 Swift Proxy" dnf install -y openstack-swift-proxy python3-swiftclient python3-keystoneclient \
        python3-keystonemiddleware memcached

    cat > /etc/swift/proxy-server.conf << EOF
[DEFAULT]
bind_port = 8080
user = swift
swift_dir = /etc/swift

[pipeline:main]
pipeline = catch_errors gatekeeper healthcheck proxy-logging cache container_sync bulk tempurl ratelimit authtoken keystoneauth container-quotas account-quotas slo dlo versioned_writes proxy-logging proxy-server

[app:proxy-server]
use = egg:swift#proxy
allow_account_management = true
account_autocreate = true

[filter:keystoneauth]
use = egg:swift#keystoneauth
operator_roles = admin,member,myrole

[filter:authtoken]
paste.filter_factory = keystonemiddleware.auth_token:filter_factory
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_id = default
user_domain_id = default
project_name = service
username = swift
password = $SWIFT_PASS
delay_auth_decision = True
service_token_roles_required = True

[filter:cache]
use = egg:swift#memcache
memcache_servers = controller:11211

[filter:ratelimit]
use = egg:swift#ratelimit

[filter:domain_remap]
use = egg:swift#domain_remap

[filter:catch_errors]
use = egg:swift#catch_errors

[filter:cname_lookup]
use = egg:swift#cname_lookup

[filter:staticweb]
use = egg:swift#staticweb

[filter:tempurl]
use = egg:swift#tempurl

[filter:formpost]
use = egg:swift#formpost

[filter:name_check]
use = egg:swift#name_check

[filter:list-endpoints]
use = egg:swift#list_endpoints

[filter:proxy-logging]
use = egg:swift#proxy_logging

[filter:bulk]
use = egg:swift#bulk

[filter:slo]
use = egg:swift#slo

[filter:dlo]
use = egg:swift#dlo

[filter:container-quotas]
use = egg:swift#container_quotas

[filter:account-quotas]
use = egg:swift#account_quotas

[filter:gatekeeper]
use = egg:swift#gatekeeper

[filter:container_sync]
use = egg:swift#container_sync

[filter:healthcheck]
use = egg:swift#healthcheck

[filter:versioned_writes]
use = egg:swift#versioned_writes
EOF

    # 创建 swift 基础配置文件(ring 稍后创建)
    mkdir -p /etc/swift
    chown -R root:swift /etc/swift

    cat > /etc/swift/swift.conf << EOF
[swift-hash]
swift_hash_path_suffix = $(openssl rand -hex 8)
swift_hash_path_prefix = $(openssl rand -hex 8)

[storage-policy:0]
name = Policy-0
default = yes
EOF

    # 初始化 ring
    cd /etc/swift
    swift-ring-builder account.builder create 10 1 1
    swift-ring-builder container.builder create 10 1 1
    swift-ring-builder object.builder create 10 1 1

    # 如果已知 Compute IP，直接加入 ring
    if [[ -n "${COMPUTE_IP:-}" ]]; then
        info "将 Compute 节点 ($COMPUTE_IP) 加入 Swift ring..."
        swift-ring-builder account.builder add --region 1 --zone 1 --ip "$COMPUTE_IP" --port 6202 --device sdb --weight 100
        swift-ring-builder container.builder add --region 1 --zone 1 --ip "$COMPUTE_IP" --port 6201 --device sdb --weight 100
        swift-ring-builder object.builder add --region 1 --zone 1 --ip "$COMPUTE_IP" --port 6200 --device sdb --weight 100
        swift-ring-builder account.builder rebalance
        swift-ring-builder container.builder rebalance
        swift-ring-builder object.builder rebalance
    else
        warn "未提供 Compute IP，ring 为空，需在 Compute 部署后手动构建"
    fi

    systemctl enable openstack-swift-proxy.service memcached.service
    systemctl restart openstack-swift-proxy.service memcached.service

    # 验证
    sleep 3
    swift stat 2>/dev/null || warn "Swift 将在 Compute 节点部署存储后端后完全可用"

    success "Swift Controller (proxy) 部署完成"
    mark_stage "swift_ctrl"
}

# ─── C10: Horizon ───────────────────────────────────────────────
stage_horizon_ctrl() {
    skip_if_done "horizon" && return
    step "C10: Horizon Dashboard"

    run_verbose "安装 Horizon Dashboard" dnf install -y openstack-dashboard

    # 备份原始配置
    cp /etc/openstack-dashboard/local_settings /etc/openstack-dashboard/local_settings.bak 2>/dev/null || true

    cat > /etc/openstack-dashboard/local_settings << EOF
import os
from django.utils.translation import gettext_lazy as _

DEBUG = False
ALLOWED_HOSTS = ['*', ]

OPENSTACK_API_VERSIONS = {
    "identity": 3,
    "image": 2,
    "volume": 3,
}

OPENSTACK_KEYSTONE_MULTIDOMAIN_SUPPORT = True
OPENSTACK_KEYSTONE_DEFAULT_DOMAIN = "Default"
OPENSTACK_KEYSTONE_DEFAULT_ROLE = "member"

OPENSTACK_HOST = "controller"
OPENSTACK_KEYSTONE_URL = "http://%s:5000/v3" % OPENSTACK_HOST
OPENSTACK_KEYSTONE_DEFAULT_ROLE = "member"

SESSION_ENGINE = 'django.contrib.sessions.backends.cache'
CACHES = {
    'default': {
        'BACKEND': 'django.core.cache.backends.memcached.MemcachedCache',
        'LOCATION': 'controller:11211',
    }
}

WEBROOT = '/dashboard'
POLICY_FILES_PATH = "/etc/openstack-dashboard"

OPENSTACK_NEUTRON_NETWORK = {
    'enable_router': True,
    'enable_quotas': True,
    'enable_distributed_router': False,
    'enable_ha_router': False,
    'enable_lb': False,
    'enable_firewall': False,
    'enable_vpn': False,
    'enable_fip_topology_check': True,
}

TIME_ZONE = "Asia/Shanghai"

# 禁用 JS/CSS 压缩, 浏览器直接加载源码文件
COMPRESS_ENABLED = False
COMPRESS_OFFLINE = False
EOF

    # 修复权限: 预建 .secret_key_store, 确保 apache 可读
    # 必须预建而非删除, 因为 httpd 启动时 Django 加载 settings 可能以 root 身份运行,
    # 若文件不存在会以 root 创建, 导致 apache 无读取权限
    local local_dir="/usr/share/openstack-dashboard/openstack_dashboard/local"
    mkdir -p "$local_dir"
    chown -R apache:apache "$local_dir"
    if [[ ! -s "$local_dir/.secret_key_store" ]]; then
        python3 -c "import secrets; print(secrets.token_hex(32))" > "$local_dir/.secret_key_store"
    fi
    chown apache:apache "$local_dir/.secret_key_store" 2>/dev/null || true
    chmod 600 "$local_dir/.secret_key_store"
    rm -f "$local_dir"/.secret_key_store.lock

    # 修复 Horizon Swift 上传 "文件名称已存在" bug
    # 根因: HTML 模板中 object-name-exists 指令调用 getObjectDetails(ignoreError=true)
    #       ignoreError 用 angular.noop 吞掉 404 reject → 校验永远判定"已存在"
    # 修复: 从 HTML 模板 + 预编译缓存 JS 中移除该指令属性
    #      同时清空指令源文件使其变成无操作
    info "修复 Horizon Swift 上传校验 bug..."
    local h="/usr/share/openstack-dashboard"
    # 清空指令源文件, 使其不注册校验
    echo '// disabled: object-name-exists validation removed' > \
        "$h/static/dashboard/project/containers/object-name-exists.directive.js"
    # 从 HTML 模板中移除该属性 (源位置 + 静态副本)
    sed -i 's/object-name-exists//g' \
        "$h/openstack_dashboard/dashboards/project/static/dashboard/project/containers/upload-object-modal.html" 2>/dev/null || true
    sed -i 's/object-name-exists//g' \
        "$h/static/dashboard/project/containers/upload-object-modal.html" 2>/dev/null || true
    # 从预编译模板缓存 JS 中移除该属性
    sed -i 's/object-name-exists//g' \
        "$h"/static/dashboard/js/angular_template_cache_preloads.*.js 2>/dev/null || true
    success "Horizon Swift 上传 bug 已修复"

    systemctl restart httpd memcached

    # 验证
    sleep 3
    if curl -s -o /dev/null -w "%{http_code}" "http://controller/dashboard/" 2>/dev/null | grep -q "200\|301\|302"; then
        success "Horizon 可访问"
    else
        warn "Horizon 可能尚未就绪，请稍后手动访问 http://$MGMT_IP/dashboard/ 验证"
    fi

    success "Horizon 部署完成"
    mark_stage "horizon"
}

# ─── C11: Controller 验证 ──────────────────────────────────────
stage_verify_ctrl() {
    skip_if_done "verify_ctrl" && return
    step "C11: Controller 环境验证"

    source ~/admin-openrc

    echo ""
    info "验证 Keystone..."
    openstack token issue > /dev/null && success "Keystone ✓" || warn "Keystone ✗"

    info "验证 Glance..."
    openstack image list > /dev/null && success "Glance ✓" || warn "Glance ✗"

    info "验证 Placement..."
    openstack --os-placement-api-version 1.2 resource class list --sort-column name > /dev/null 2>&1 && \
        success "Placement ✓" || warn "Placement ✗"

    info "验证 Nova..."
    openstack compute service list > /dev/null && success "Nova ✓" || warn "Nova ✗"

    info "验证 Neutron..."
    openstack network agent list > /dev/null && success "Neutron ✓" || warn "Neutron ✗"

    info "验证 Cinder..."
    openstack volume service list > /dev/null && success "Cinder ✓" || warn "Cinder ✗"

    info "验证 Swift..."
    swift stat > /dev/null 2>&1 && success "Swift ✓" || warn "Swift ✗ (Compute 节点部署后可用)"

    echo ""
    echo -e "${GREEN}╔══════════════════════════════════════════════════╗${NC}"
    echo -e "${GREEN}║        Controller 部署完成!                       ║${NC}"
    echo -e "${GREEN}╠══════════════════════════════════════════════════╣${NC}"
    echo -e "${GREEN}║${NC}  Horizon:  ${CYAN}http://$MGMT_IP/dashboard${NC}"
    echo -e "${GREEN}║${NC}  Admin:    ${CYAN}admin / $ADMIN_PASS${NC}"
    echo -e "${GREEN}║${NC}  日志:     ${CYAN}$LOG_DIR${NC}"
    echo -e "${GREEN}║${NC}  备份:     ${CYAN}$BACKUP_DIR${NC}"
    echo -e "${GREEN}╚══════════════════════════════════════════════════╝${NC}"
    echo ""
    if [[ "$DEPLOY_MODE" != "allinone" ]]; then
        info "请将此脚本复制到 Compute 节点，选择 [2] Compute 模式继续部署"
    fi

    mark_stage "verify_ctrl"
}

# ─── C12: All-in-One 远程部署 Compute ──────────────────────────
stage_deploy_compute_remote() {
    skip_if_done "remote_compute" && return
    step "C12: 远程部署 Compute 节点 (All-in-One)"

    if [[ -z "${COMPUTE_ROOT_PASS:-}" ]]; then
        while true; do
            read -rsp "请输入 Compute 节点 root 密码: " COMPUTE_ROOT_PASS
            echo ""
            [[ -z "$COMPUTE_ROOT_PASS" ]] && error "Compute root 密码不能为空"

            # 验证密码
            if ! command -v sshpass &>/dev/null; then
                dnf install -y sshpass >> "$LOG_FILE" 2>&1 || error "无法安装 sshpass"
            fi
            if sshpass -p "$COMPUTE_ROOT_PASS" ssh -o StrictHostKeyChecking=no -o ConnectTimeout=5 \
                "root@$COMPUTE_IP" "echo ok" 2>/dev/null; then
                success "Compute 密码验证通过"
                break
            else
                warn "无法连接到 Compute ($COMPUTE_IP)，密码或网络错误"
                read -rp "是否重新输入? [Y/n]: " retry
                if [[ "$retry" =~ ^[Nn]$ ]]; then
                    error "用户取消，无法继续远程部署"
                fi
            fi
        done
    fi

    # 安装 sshpass + 配置免密登录
    if ! command -v sshpass &>/dev/null; then
        dnf install -y sshpass >> "$LOG_FILE" 2>&1 || error "无法安装 sshpass"
    fi
    info "配置 SSH 免密登录到 Compute ($COMPUTE_IP)..."
    if sshpass -p "$COMPUTE_ROOT_PASS" ssh-copy-id -o StrictHostKeyChecking=no "root@$COMPUTE_IP" >> "$LOG_FILE" 2>&1; then
        success "SSH 免密已配置: root@$COMPUTE_IP"
    else
        error "SSH 免密配置失败，请检查 Compute IP ($COMPUTE_IP) 和 root 密码是否正确"
    fi

    # 传输脚本
    info "传输部署脚本到 Compute..."
    if scp -o StrictHostKeyChecking=no "$SCRIPT_DIR/deploy-openstack.sh" "root@$COMPUTE_IP:/root/" >> "$LOG_FILE" 2>&1; then
        success "脚本已传输到 Compute:/root/"
    else
        error "脚本传输失败，请检查 Compute 网络连通性"
    fi

    # 写入 state file
    info "写入 Compute 部署配置..."
    generate_compute_state_file | ssh -o StrictHostKeyChecking=no "root@$COMPUTE_IP" \
        "cat > /root/.deploy_state" 2>&1 | tee -a "$LOG_FILE"
    success "Compute state file 已写入"

    # 远程执行 Compute 部署 (实时输出)
    step "开始远程部署 Compute 节点 (实时输出)"
    ssh -o StrictHostKeyChecking=no "root@$COMPUTE_IP" \
        "bash /root/deploy-openstack.sh" 2>&1 | tee -a "$LOG_FILE"
    local rc=${PIPESTATUS[0]}
    if [[ $rc -ne 0 ]]; then
        error "Compute 远程部署失败 (exit code: $rc), 检查日志 $LOG_FILE"
    fi
    success "Compute 远程部署完成"

    # 清除密码
    unset COMPUTE_ROOT_PASS

    mark_stage "remote_compute"
}

# ─── C13: All-in-One 本地发现 Compute 节点 ─────────────────────
stage_discover_hosts_local() {
    skip_if_done "discover_hosts" && return
    step "C13: 发现并验证 Compute 节点"

    source ~/admin-openrc

    info "发现新计算节点..."
    su -s /bin/sh -c "nova-manage cell_v2 discover_hosts --verbose" nova 2>&1 | tee -a "$LOG_FILE"
    success "节点发现完成"

    sleep 3
    info "Compute Service 列表:"
    openstack compute service list 2>&1 | tee -a "$LOG_FILE"

    if openstack compute service list 2>/dev/null | grep -q "nova-compute.*up"; then
        success "Compute 节点已注册并状态 UP"
    else
        warn "Compute 节点可能尚未完全注册，请检查上述输出"
    fi

    echo ""
    echo -e "${GREEN}╔══════════════════════════════════════════════════╗${NC}"
    echo -e "${GREEN}║        All-in-One 双节点部署完成!                  ║${NC}"
    echo -e "${GREEN}╠══════════════════════════════════════════════════╣${NC}"
    echo -e "${GREEN}║${NC}  Horizon:  ${CYAN}http://$MGMT_IP/dashboard${NC}"
    echo -e "${GREEN}║${NC}  Admin:    ${CYAN}admin / $ADMIN_PASS${NC}"
    echo -e "${GREEN}║${NC}  日志:     ${CYAN}$LOG_DIR${NC}"
    echo -e "${GREEN}╚══════════════════════════════════════════════════╝${NC}"

    mark_stage "discover_hosts"
}

# ╔══════════════════════════════════════════════════════════════╗
# ║              Compute 阶段                                   ║
# ╚══════════════════════════════════════════════════════════════╝

# ─── N1: Compute 环境准备 ──────────────────────────────────────
stage_env_prep_cmpt() {
    skip_if_done "env_prep" && return
    step "N1: Compute 环境准备"

    setenforce 0 || true
    sed -i 's/^SELINUX=enforcing/SELINUX=disabled/' /etc/selinux/config
    success "SELinux → disabled"

    systemctl stop firewalld 2>/dev/null || true
    systemctl disable firewalld 2>/dev/null || true
    success "firewalld → disabled"

    hostnamectl set-hostname compute
    echo "compute" > /etc/hostname
    success "主机名: compute"

    grep -q "controller" /etc/hosts 2>/dev/null || \
        echo "$CONTROLLER_IP   controller" >> /etc/hosts
    grep -q "compute" /etc/hosts 2>/dev/null || \
        echo "$MGMT_IP   compute" >> /etc/hosts
    success "/etc/hosts 已更新"

    # 配置静态 IP (防止 DHCP 租约过期后 IP 变动)
    if [[ "$STATIC_IP_ENABLED" != "no" ]]; then
        local mgmt_iface
        mgmt_iface=$(detect_mgmt_iface "$MGMT_IP")
        if [[ -n "$mgmt_iface" ]]; then
            set_static_ip "$mgmt_iface" "$MGMT_IP" || warn "静态 IP 配置失败，请手动设置"
        else
            warn "无法检测管理网卡，跳过静态 IP 配置"
        fi
    else
        info "已跳过静态 IP 配置 (用户选择保持 DHCP)"
    fi

    if ! rpm -q openstack-release-antelope &>/dev/null; then
        warn "yum update 可能需要 10-30 分钟，请耐心等待..."
        run_verbose "系统包更新 (yum update)" yum update -y
        wait_dnf 60
        run_verbose "安装 OpenStack Release 包" yum install -y openstack-release-antelope
    fi
    if ! grep -q '^\[EPOL\]' /etc/yum.repos.d/openEuler.repo 2>/dev/null; then
        cat >> /etc/yum.repos.d/openEuler.repo << 'EOF'
[EPOL]
name=EPOL
baseurl=http://repo.openeuler.org/openEuler-24.03-LTS-SP2/EPOL/main/$basearch/
enabled=1
gpgcheck=1
gpgkey=http://repo.openeuler.org/openEuler-24.03-LTS-SP2/OS/$basearch/RPM-GPG-KEY-openEuler
EOF
    fi
    run_verbose "刷新 YUM 缓存" bash -c "yum clean all && yum makecache"

    # Chrony 同步 Controller
    dnf install -y chrony >> "$LOG_FILE" 2>&1
    sed -i '/^pool /s/^/#/' /etc/chrony.conf
    sed -i '/^server /d' /etc/chrony.conf
    echo "server $CONTROLLER_IP iburst" >> /etc/chrony.conf
    systemctl restart chronyd
    systemctl enable chronyd
    success "Chrony 已配置同步 $CONTROLLER_IP"

    success "Compute 环境准备完成"
    mark_stage "env_prep"
}

# ─── N2: 前置检查 ──────────────────────────────────────────────
stage_pre_check_cmpt() {
    skip_if_done "pre_check" && return
    step "N2: 检查 Controller 可访问性"

    info "检查 Controller 端口..."
    local ok=true

    if wait_port "$CONTROLLER_IP" 5000 30; then
        success "Keystone ($CONTROLLER_IP:5000) 可达"
    else
        warn "Keystone ($CONTROLLER_IP:5000) 不可达"
        ok=false
    fi

    if wait_port "$CONTROLLER_IP" 5672 10; then
        success "RabbitMQ ($CONTROLLER_IP:5672) 可达"
    else
        warn "RabbitMQ ($CONTROLLER_IP:5672) 不可达"
        ok=false
    fi

    if wait_port "$CONTROLLER_IP" 3306 10; then
        success "MariaDB ($CONTROLLER_IP:3306) 可达"
    else
        warn "MariaDB ($CONTROLLER_IP:3306) 不可达"
        ok=false
    fi

    if [[ "$ok" == "false" ]]; then
        error "请确保 Controller 节点已部署完成且网络可达"
    fi

    mark_stage "pre_check"
}

# ─── N3: Nova Compute ──────────────────────────────────────────
stage_nova_cmpt() {
    skip_if_done "nova_compute" && return
    step "N3: Nova Compute"

    run_verbose "安装 Nova Compute" dnf install -y openstack-nova-compute

    cat > /etc/nova/nova.conf << EOF
[DEFAULT]
enabled_apis = osapi_compute,metadata
transport_url = rabbit://openstack:$RABBIT_PASS@controller:5672/
my_ip = $MGMT_IP
compute_driver = libvirt.LibvirtDriver
instances_path = /var/lib/nova/instances
log_dir = /var/log/nova

[api]
auth_strategy = keystone

[keystone_authtoken]
auth_url = http://controller:5000/v3
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = nova
password = $NOVA_PASS

[vnc]
enabled = true
server_listen = \$my_ip
server_proxyclient_address = \$my_ip
novncproxy_base_url = http://controller:6080/vnc_auto.html

[glance]
api_servers = http://controller:9292

[oslo_concurrency]
lock_path = /var/lib/nova/tmp

[placement]
region_name = RegionOne
project_domain_name = Default
project_name = service
auth_type = password
user_domain_name = Default
auth_url = http://controller:5000/v3
username = placement
password = $PLACEMENT_PASS

[neutron]
auth_url = http://controller:5000
auth_type = password
project_domain_name = Default
user_domain_name = Default
region_name = RegionOne
project_name = service
username = neutron
password = $NEUTRON_PASS
EOF

    # 硬件加速检测
    if [[ "$IS_ARM" == "true" ]]; then
        info "ARM64: 检测硬件加速..."
        if virt-host-validate 2>/dev/null | grep -q "FAIL"; then
            warn "ARM 平台不支持 KVM 加速，使用 QEMU"
            cat >> /etc/nova/nova.conf << EOF

[libvirt]
virt_type = qemu
EOF
            # qemu arm64 额外配置
            cat >> /etc/libvirt/qemu.conf << EOF
nvram = ["/usr/share/AAVMF/AAVMF_CODE.fd:/usr/share/AAVMF/AAVMF_VARS.fd", "/usr/share/edk2/aarch64/QEMU_EFI-pflash.raw:/usr/share/edk2/aarch64/vars-template-pflash.raw"]
EOF
        else
            info "ARM64: KVM 加速可用"
        fi
    else
        local vmx_count
        vmx_count=$(egrep -c '(vmx|svm)' /proc/cpuinfo 2>/dev/null || echo 0)
        if [[ "$vmx_count" -eq 0 ]]; then
            warn "x86: CPU 不支持硬件加速，使用 QEMU"
            cat >> /etc/nova/nova.conf << EOF

[libvirt]
virt_type = qemu
EOF
        else
            success "x86: KVM 加速可用"
        fi
    fi

    # 修复 compute_id 权限
    chown nova:nova /usr/lib/python3.11/site-packages/

    # 先启动 libvirtd（非 socket 模式），再启动 nova-compute
    systemctl restart libvirtd.service
    sleep 2
    systemctl enable libvirtd.service openstack-nova-compute.service
    systemctl restart openstack-nova-compute.service

    success "Nova Compute 部署完成"
    mark_stage "nova_compute"
}

# ─── N4: Neutron Compute ───────────────────────────────────────
stage_neutron_cmpt() {
    skip_if_done "neutron_compute" && return
    step "N4: Neutron Compute (Linuxbridge Agent)"

    run_verbose "安装 Neutron Agent" dnf install -y openstack-neutron-linuxbridge ebtables ipset

    cat > /etc/neutron/neutron.conf << EOF
[DEFAULT]
transport_url = rabbit://openstack:$RABBIT_PASS@controller
auth_strategy = keystone

[keystone_authtoken]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = neutron
password = $NEUTRON_PASS

[oslo_concurrency]
lock_path = /var/lib/neutron/tmp
EOF

    cat > /etc/neutron/plugins/ml2/linuxbridge_agent.ini << EOF
[linux_bridge]
physical_interface_mappings = provider:$PROVIDER_IFACE

[vxlan]
enable_vxlan = true
local_ip = $MGMT_IP
l2_population = true

[securitygroup]
enable_security_group = true
firewall_driver = neutron.agent.linux.iptables_firewall.IptablesFirewallDriver
EOF

    systemctl restart openstack-nova-compute.service

    systemctl enable neutron-linuxbridge-agent
    systemctl restart neutron-linuxbridge-agent

    success "Neutron Compute 部署完成"
    mark_stage "neutron_compute"
}

# ─── N5: Cinder Compute ────────────────────────────────────────
stage_cinder_cmpt() {
    skip_if_done "cinder_compute" && return
    step "N5: Cinder Compute (LVM Volume)"

    # 自动检测空闲磁盘
    if [[ -z "$CINDER_DISK" ]]; then
        CINDER_DISK=$(detect_free_disk)
        if [[ -n "$CINDER_DISK" ]]; then
            info "自动检测到空闲磁盘: $CINDER_DISK，将用于 Cinder LVM"
            save_state_var "CINDER_DISK" "$CINDER_DISK"
        fi
    fi

    if [[ -z "$CINDER_DISK" ]]; then
        warn "未检测到空闲磁盘，Cinder LVM 跳过"
        warn "原因: 所有磁盘已被分区/挂载/或被 LVM 占用"
        info "当前磁盘布局:"
        lsblk -o NAME,TYPE,SIZE,MOUNTPOINT 2>/dev/null | tee -a "$LOG_FILE"
        info "修复: 添加一块新磁盘后执行 $0 --force cinder_compute"
        mark_stage "cinder_compute"
        return
    fi

    if [[ ! -b "$CINDER_DISK" ]]; then
        warn "磁盘 $CINDER_DISK 不存在, 跳过 Cinder"
        mark_stage "cinder_compute"
        return
    fi

    run_verbose "安装 Cinder Volume (LVM+iSCSI)" dnf install -y lvm2 device-mapper-persistent-data \
        scsi-target-utils rpcbind nfs-utils targetcli iscsi-initiator-utils openstack-cinder-volume

    # iSCSI target 初始化
    mkdir -p /etc/target
    mount -t configfs configfs /sys/kernel/config 2>/dev/null || true
    grep -q "/sys/kernel/config" /etc/fstab || \
        echo "configfs /sys/kernel/config configfs defaults 0 0" >> /etc/fstab
    modprobe target_core_mod iscsi_target_mod 2>/dev/null || true
    echo -e "target_core_mod\niscsi_target_mod" > /etc/modules-load.d/cinder-iscsi.conf

    # iSCSI initiator
    local initiator_iqn="iqn.2012-01.com.openeuler:$(hostname)"
    echo "InitiatorName=$initiator_iqn" > /etc/iscsi/initiatorname.iscsi
    systemctl enable iscsid --now 2>/dev/null || true

    # 创建 LVM 卷组
    if ! vgs cinder-volumes &>/dev/null; then
        run_verbose "创建 LVM 物理卷" pvcreate "$CINDER_DISK" -y
        run_verbose "创建 LVM 卷组" vgcreate cinder-volumes "$CINDER_DISK"
    else
        success "LVM 卷组 cinder-volumes 已存在"
    fi

    cat > /etc/cinder/cinder.conf << EOF
[DEFAULT]
transport_url = rabbit://openstack:$RABBIT_PASS@controller
auth_strategy = keystone
my_ip = $MGMT_IP
enabled_backends = lvm
glance_api_servers = http://controller:9292

[keystone_authtoken]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
memcached_servers = controller:11211
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = cinder
password = $CINDER_PASS

[database]
connection = mysql+pymysql://cinder:$CINDER_DBPASS@controller/cinder

[glance]
www_authenticate_uri = http://controller:5000
auth_url = http://controller:5000
auth_type = password
project_domain_name = Default
user_domain_name = Default
project_name = service
username = cinder
password = $CINDER_PASS
region_name = RegionOne

[lvm]
volume_driver = cinder.volume.drivers.lvm.LVMVolumeDriver
volume_group = cinder-volumes
target_protocol = iscsi
target_helper = lioadm

[oslo_concurrency]
lock_path = /var/lib/cinder/tmp
EOF

    systemctl enable openstack-cinder-volume 2>/dev/null || true
    systemctl restart openstack-cinder-volume

    success "Cinder Compute 部署完成"
    mark_stage "cinder_compute"
}

# ─── N6: Swift Compute ─────────────────────────────────────────
stage_swift_cmpt() {
    skip_if_done "swift_compute" && return
    step "N6: Swift 对象存储 (Compute)"

    run_verbose "安装 Swift 存储服务" dnf install -y openstack-swift-account openstack-swift-container \
        openstack-swift-object xfsprogs rsync

    # 查找可用磁盘做 Swift，如无则用 loopback
    local swift_disk=""
    local swift_device=""
    swift_disk=$(detect_free_disk)

    if [[ -n "$swift_disk" && "$swift_disk" != "$CINDER_DISK" ]]; then
        info "使用磁盘 $swift_disk 作为 Swift 存储"
        swift_device="sdb1"
        if mkfs.xfs -f "$swift_disk" >> "$LOG_FILE" 2>&1; then
            success "XFS 格式化完成"
        else
            warn "mkfs.xfs 格式化 $swift_disk 失败 (设备忙或不存在), 回退到 loopback"
            swift_disk=""
        fi
    fi

    if [[ -n "$swift_disk" && "$swift_disk" != "$CINDER_DISK" ]]; then
        mkdir -p /srv/node/sdb
        mount "$swift_disk" /srv/node/sdb || warn "挂载 $swift_disk 失败"
        local uuid
        uuid=$(blkid -s UUID -o value "$swift_disk" 2>/dev/null || echo "")
        if [[ -n "$uuid" ]]; then
            echo "UUID=$uuid /srv/node/sdb xfs noatime 0 2" >> /etc/fstab
        fi
    else
        warn "无独立磁盘用于 Swift, 使用 loopback 设备 (仅供测试)"
        SWIFT_LOOPBACK=true
        mkdir -p /srv/node/sdb
        dd if=/dev/zero of=/srv/swift-disk.img bs=1G count=10 2>>"$LOG_FILE" && \
            mkfs.xfs -f /srv/swift-disk.img >> "$LOG_FILE" 2>&1 && \
            mount -o loop /srv/swift-disk.img /srv/node/sdb
        swift_device="sdb1"
    fi

    # rsyncd 配置
    cat > /etc/rsyncd.conf << EOF
uid = swift
gid = swift
log file = /var/log/rsyncd.log
pid file = /var/run/rsyncd.pid
address = $MGMT_IP

[account]
max connections = 2
path = /srv/node/
read only = False
lock file = /var/lock/account.lock

[container]
max connections = 2
path = /srv/node/
read only = False
lock file = /var/lock/container.lock

[object]
max connections = 2
path = /srv/node/
read only = False
lock file = /var/lock/object.lock
EOF

    systemctl enable rsyncd.service
    systemctl restart rsyncd.service

    # 配置 account/container/object server
    for svc in account container object; do
        cat > "/etc/swift/${svc}-server.conf" << EOF
[DEFAULT]
bind_ip = $MGMT_IP
bind_port = 6$(case "$svc" in account) echo 202;; container) echo 201;; object) echo 200;; esac)
user = swift
swift_dir = /etc/swift
devices = /srv/node
mount_check = false

[pipeline:main]
pipeline = healthcheck recon ${svc}-server

[app:${svc}-server]
use = egg:swift#${svc}

[filter:healthcheck]
use = egg:swift#healthcheck

[filter:recon]
use = egg:swift#recon
recon_cache_path = /var/cache/swift
EOF
    done

    chown -R swift:swift /srv/node
    mkdir -p /var/cache/swift
    chown -R root:swift /var/cache/swift
    chmod -R 775 /var/cache/swift

    # 启动 Swift 存储服务
    systemctl enable openstack-swift-account.service openstack-swift-account-auditor.service \
        openstack-swift-account-reaper.service openstack-swift-account-replicator.service \
        openstack-swift-container.service openstack-swift-container-auditor.service \
        openstack-swift-container-replicator.service openstack-swift-container-updater.service \
        openstack-swift-object.service openstack-swift-object-auditor.service \
        openstack-swift-object-replicator.service openstack-swift-object-updater.service

    systemctl restart openstack-swift-account.service openstack-swift-account-auditor.service \
        openstack-swift-account-reaper.service openstack-swift-account-replicator.service \
        openstack-swift-container.service openstack-swift-container-auditor.service \
        openstack-swift-container-replicator.service openstack-swift-container-updater.service \
        openstack-swift-object.service openstack-swift-object-auditor.service \
        openstack-swift-object-replicator.service openstack-swift-object-updater.service

    # 将 Compute 节点注册到 Ring (需要在 Controller 上操作)
    # 此处告知用户: 在 Controller 上运行 ring 构建
    info "Swift 存储服务已启动"
    info "请在 Controller 节点执行 ring 构建命令将本节点加入 ring, 或重新运行:"
    info "  $0 --force swift_ctrl  (在 Controller 上)"
    info "  或手动构建 ring (详见官方文档)"

    if [[ "$SWIFT_LOOPBACK" == "true" ]]; then
        warn "⚠ Swift 使用 loopback 模式, 仅适用于测试环境!"
        warn "  生产环境请配置至少 2 块独立磁盘"
    fi

    success "Swift Compute 部署完成"
    mark_stage "swift_compute"
}

# ─── N7: Compute 验证 ──────────────────────────────────────────
stage_verify_cmpt() {
    skip_if_done "verify_compute" && return
    step "N7: Compute 环境验证 & 节点发现"

    if [[ -n "${CTRL_ROOT_PASS:-}" ]]; then
        # 自动 SSH 模式
        setup_ssh_to_controller "$CONTROLLER_IP" "$CTRL_ROOT_PASS"

        info "在 Controller 上发现新计算节点..."
        local discover_out
        discover_out=$(ssh -o StrictHostKeyChecking=no "root@$CONTROLLER_IP" \
            "source ~/admin-openrc && su -s /bin/sh -c 'nova-manage cell_v2 discover_hosts --verbose' nova" 2>&1) || true
        echo "$discover_out"
        if echo "$discover_out" | grep -qE "Found|mapped|Host"; then
            success "节点发现完成"
        else
            info "节点发现输出如上"
        fi

        sleep 3
        info "验证 Compute Service 列表..."
        local svc_list
        svc_list=$(ssh -o StrictHostKeyChecking=no "root@$CONTROLLER_IP" \
            "source ~/admin-openrc && openstack compute service list" 2>&1) || true
        echo "$svc_list"

        if echo "$svc_list" | grep -q "nova-compute.*up"; then
            success "Compute 节点已注册并状态 UP"
        else
            warn "Compute 节点可能尚未完全注册，请检查上述输出"
        fi

        # 清除密码
        unset CTRL_ROOT_PASS
    else
        # 手动模式: 打印操作提示
        info "等待计算节点注册到 Controller..."
        sleep 5
        info "提示: 请在 Controller 节点上执行以下命令以发现计算节点:"
        info "  ssh controller 'source ~/admin-openrc && su -s /bin/sh -c \"nova-manage cell_v2 discover_hosts --verbose\" nova'"
        info "  或直接在 Controller 终端执行:"
        info "  source ~/admin-openrc"
        info "  su -s /bin/sh -c \"nova-manage cell_v2 discover_hosts --verbose\" nova"
        info "  openstack compute service list"
    fi

    echo ""
    echo -e "${GREEN}╔══════════════════════════════════════════════════╗${NC}"
    echo -e "${GREEN}║        Compute 部署完成!                          ║${NC}"
    echo -e "${GREEN}╠══════════════════════════════════════════════════╣${NC}"
    if [[ -z "${CTRL_ROOT_PASS:-}" ]]; then
        echo -e "${GREEN}║${NC}  请返回 Controller 节点执行 discover_hosts     ${NC}"
    fi
    echo -e "${GREEN}║${NC}  日志: ${CYAN}$LOG_DIR${NC}"
    echo -e "${GREEN}╚══════════════════════════════════════════════════╝${NC}"

    mark_stage "verify_compute"
}

# ╔══════════════════════════════════════════════════════════════╗
# ║              主流程                                         ║
# ╚══════════════════════════════════════════════════════════════╝

print_status() {
    echo ""
    echo -e "${CYAN}当前部署进度:${NC}"
    if [[ -f "$STATE_FILE" ]]; then
        local completed
        completed=$(get_state_var "COMPLETED")
        local node_type
        node_type=$(get_state_var "NODE_TYPE")
        echo -e "  节点类型: ${GREEN}${node_type:-未设置}${NC}"
        echo -e "  已完成阶段: ${GREEN}${completed:-无}${NC}"
    else
        echo -e "  ${YELLOW}尚未开始${NC}"
    fi
    echo ""
}

parse_args() {
    FORCE_STAGE=""
    DRY_RUN=false
    while [[ $# -gt 0 ]]; do
        case "$1" in
            --force)
                FORCE_STAGE="$2"
                shift 2
                ;;
            --status)
                print_status
                exit 0
                ;;
            --dry-run)
                DRY_RUN=true
                shift
                ;;
            *)
                shift
                ;;
        esac
    done
}

main() {
    parse_args "$@"

    # 初始化日志
    mkdir -p "$LOG_DIR"
    exec 2> >(tee -a "$LOG_FILE" >&2)

    # 如果是首次运行，进行交互式配置
    if [[ ! -f "$STATE_FILE" ]]; then
        check_root
        interactive_config
    else
        # 加载已有状态
        NODE_TYPE=$(get_state_var "NODE_TYPE")
        MGMT_IP=$(get_state_var "MGMT_IP")
        CONTROLLER_IP=$(get_state_var "CONTROLLER_IP")
        COMPUTE_IP=$(get_state_var "COMPUTE_IP")
        PROVIDER_IFACE=$(get_state_var "PROVIDER_IFACE")
        COMPUTE_PROVIDER_IFACE=$(get_state_var "COMPUTE_PROVIDER_IFACE")
        CINDER_DISK=$(get_state_var "CINDER_DISK")
        PASSWORD_MODE=$(get_state_var "PASSWORD_MODE")
        DEPLOY_MODE=$(get_state_var "DEPLOY_MODE")
        STATIC_IP_ENABLED=$(get_state_var "STATIC_IP_ENABLED"); [[ -z "$STATIC_IP_ENABLED" ]] && STATIC_IP_ENABLED="yes"
        COMPUTE_STATIC_IP_ENABLED=$(get_state_var "COMPUTE_STATIC_IP_ENABLED"); [[ -z "$COMPUTE_STATIC_IP_ENABLED" ]] && COMPUTE_STATIC_IP_ENABLED="yes"
        # 加载密码变量 (All-in-One 远程部署 / 恢复自定义密码场景)
        local pwd
        pwd=$(get_state_var "ADMIN_PASS"); [[ -n "$pwd" ]] && ADMIN_PASS="$pwd"
        pwd=$(get_state_var "RABBIT_PASS"); [[ -n "$pwd" ]] && RABBIT_PASS="$pwd"
        pwd=$(get_state_var "KEYSTONE_DBPASS"); [[ -n "$pwd" ]] && KEYSTONE_DBPASS="$pwd"
        pwd=$(get_state_var "GLANCE_PASS"); [[ -n "$pwd" ]] && GLANCE_PASS="$pwd"
        pwd=$(get_state_var "GLANCE_DBPASS"); [[ -n "$pwd" ]] && GLANCE_DBPASS="$pwd"
        pwd=$(get_state_var "PLACEMENT_PASS"); [[ -n "$pwd" ]] && PLACEMENT_PASS="$pwd"
        pwd=$(get_state_var "PLACEMENT_DBPASS"); [[ -n "$pwd" ]] && PLACEMENT_DBPASS="$pwd"
        pwd=$(get_state_var "NOVA_PASS"); [[ -n "$pwd" ]] && NOVA_PASS="$pwd"
        pwd=$(get_state_var "NOVA_DBPASS"); [[ -n "$pwd" ]] && NOVA_DBPASS="$pwd"
        pwd=$(get_state_var "NEUTRON_PASS"); [[ -n "$pwd" ]] && NEUTRON_PASS="$pwd"
        pwd=$(get_state_var "NEUTRON_DBPASS"); [[ -n "$pwd" ]] && NEUTRON_DBPASS="$pwd"
        pwd=$(get_state_var "CINDER_PASS"); [[ -n "$pwd" ]] && CINDER_PASS="$pwd"
        pwd=$(get_state_var "CINDER_DBPASS"); [[ -n "$pwd" ]] && CINDER_DBPASS="$pwd"
        pwd=$(get_state_var "SWIFT_PASS"); [[ -n "$pwd" ]] && SWIFT_PASS="$pwd"
        pwd=$(get_state_var "METADATA_SECRET"); [[ -n "$pwd" ]] && METADATA_SECRET="$pwd"
        info "加载已有部署状态: NODE_TYPE=$NODE_TYPE, MGMT_IP=$MGMT_IP"
        if is_stage_done "verify_ctrl" || is_stage_done "verify_compute"; then
            warn "部署已完成。使用 --force <stage> 可重跑指定阶段"
        fi
        # All-in-One 恢复: 如果已配置 Compute IP 但没密码，重新提示
        if [[ "$DEPLOY_MODE" == "allinone" && -n "${COMPUTE_IP:-}" && -z "${COMPUTE_ROOT_PASS:-}" ]]; then
            if ! is_stage_done "remote_compute" && ! is_stage_done "discover_hosts"; then
                read -rsp "请输入 Compute 节点 root 密码 (恢复部署): " COMPUTE_ROOT_PASS
                echo ""
            fi
        fi
    fi

    # 处理 --force
    if [[ -n "$FORCE_STAGE" ]]; then
        warn "强制重跑阶段: $FORCE_STAGE"
        sed -i "s/\b${FORCE_STAGE}\b//g" "$STATE_FILE" 2>/dev/null
        sed -i 's/,,*/,/g; s/^COMPLETED=,/COMPLETED=/; s/,$//' "$STATE_FILE" 2>/dev/null
    fi

    # 初始化
    stage_init

    # 根据节点类型执行阶段
    if [[ "$NODE_TYPE" == "controller" ]]; then
        stage_env_prep_ctrl
        stage_base_services_ctrl
        stage_keystone_ctrl
        stage_glance_ctrl
        stage_placement_ctrl
        stage_nova_ctrl
        stage_neutron_ctrl
        stage_cinder_ctrl
        stage_swift_ctrl
        stage_horizon_ctrl
        stage_verify_ctrl

        # All-in-One: 远程部署 Compute + 本机发现节点
        if [[ "$DEPLOY_MODE" == "allinone" ]]; then
            stage_deploy_compute_remote
            stage_discover_hosts_local
        fi
    elif [[ "$NODE_TYPE" == "compute" ]]; then
        stage_env_prep_cmpt
        stage_pre_check_cmpt
        stage_nova_cmpt
        stage_neutron_cmpt
        stage_cinder_cmpt
        stage_swift_cmpt
        stage_verify_cmpt
    else
        error "未知节点类型: $NODE_TYPE"
    fi
}

main "$@"