fix:cargo fmt

Merge remote-tracking branch 'origin/master' into feat/install_opnsense_node_exporter
2025-10-29 13:53:58 -04:00 · 2025-10-29 13:49:56 -04:00 · 2025-10-29 13:42:12 -04:00 · 2025-10-29 13:25:37 -04:00 · 2025-10-28 15:45:02 -04:00 · 2025-10-28 14:41:15 -04:00
35 changed files with 686 additions and 1751 deletions
--- a/docs/modules/Multisite_PostgreSQL.md
+++ b/docs/modules/Multisite_PostgreSQL.md
@@ -1,105 +0,0 @@
-# Design Document: Harmony PostgreSQL Module
-
-**Status:** Draft
-**Last Updated:** 2025-12-01
-**Context:** Multi-site Data Replication & Orchestration
-
-## 1. Overview
-
-The Harmony PostgreSQL Module provides a high-level abstraction for deploying and managing high-availability PostgreSQL clusters across geographically distributed Kubernetes/OKD sites.
-
-Instead of manually configuring complex replication slots, firewalls, and operator settings on each cluster, users define a single intent (a **Score**), and Harmony orchestrates the underlying infrastructure (the **Arrangement**) to establish a Primary-Replica architecture.
-
-Currently, the implementation relies on the **CloudNativePG (CNPG)** operator as the backing engine.
-
-## 2. Architecture
-
-### 2.1 The Abstraction Model
-Following **ADR 003 (Infrastructure Abstraction)**, Harmony separates the *intent* from the *implementation*.
-
-1.  **The Score (Intent):** The user defines a `MultisitePostgreSQL` resource. This describes *what* is needed (e.g., "A Postgres 15 cluster with 10GB storage, Primary on Site A, Replica on Site B").
-2.  **The Interpret (Action):** Harmony MultisitePostgreSQLInterpret processes this Score and orchestrates the deployment on both sites to reach the state defined in the Score.
-3.  **The Capability (Implementation):** The PostgreSQL Capability is implemented by the K8sTopology and the interpret can deploy it, configure it and fetch information about it. The concrete implementation will rely on the mature CloudnativePG operator to manage all the Kubernetes resources required.
-
-### 2.2 Network Connectivity (TLS Passthrough)
-
-One of the critical challenges in multi-site orchestration is secure connectivity between clusters that may have dynamic IPs or strict firewalls.
-
-To solve this, we utilize **OKD/OpenShift Routes with TLS Passthrough**.
-
-*   **Mechanism:** The Primary site exposes a `Route` configured for `termination: passthrough`.
-*   **Routing:** The OpenShift HAProxy router inspects the **SNI (Server Name Indication)** header of the incoming TCP connection to route traffic to the correct PostgreSQL Pod.
-*   **Security:** SSL is **not** terminated at the ingress router. The encrypted stream is passed directly to the PostgreSQL instance. Mutual TLS (mTLS) authentication is handled natively by CNPG between the Primary and Replica instances.
-*   **Dynamic IPs:** Because connections are established via DNS hostnames (the Route URL), this architecture is resilient to dynamic IP changes at the Primary site.
-
-#### Traffic Flow Diagram
-
-```text
-[ Site B: Replica ]                 [ Site A: Primary ]
-      |                                     |
-(CNPG Instance) --[Encrypted TCP]--> (OKD HAProxy Router)
-      |           (Port 443)                |
-      |                                     |
-      |                            [SNI Inspection]
-      |                                     |
-      |                                     v
-      |                            (PostgreSQL Primary Pod)
-      |                                   (Port 5432)
-```
-
-## 3. Design Decisions
-
-### Why CloudNativePG?
-We selected CloudNativePG because it relies exclusively on standard Kubernetes primitives and uses the native PostgreSQL replication protocol (WAL shipping/Streaming). This aligns with Harmony's goal of being "K8s Native."
-
-### Why TLS Passthrough instead of VPN/NodePort?
-*   **NodePort:** Requires static IPs and opening non-standard ports on the firewall, which violates our security constraints.
-*   **VPN (e.g., Wireguard/Tailscale):** While secure, it introduces significant complexity (sidecars, key management) and external dependencies.
-*   **TLS Passthrough:** Leverages the existing Ingress/Router infrastructure already present in OKD. It requires zero additional software and respects multi-tenancy (Routes are namespaced).
-
-### Configuration Philosophy (YAGNI)
-The current design exposes a **generic configuration surface**. Users can configure standard parameters (Storage size, CPU/Memory requests, Postgres version).
-
-**We explicitly do not expose advanced CNPG or PostgreSQL configurations at this stage.**
-
-*   **Reasoning:** We aim to keep the API surface small and manageable.
-*   **Future Path:** We plan to implement a "pass-through" mechanism to allow sending raw config maps or custom parameters to the underlying engine (CNPG) *only when a concrete use case arises*. Until then, we adhere to the **YAGNI (You Ain't Gonna Need It)** principle to avoid premature optimization and API bloat.
-
-## 4. Usage Guide
-
-To deploy a multi-site cluster, apply the `MultisitePostgreSQL` resource to the Harmony Control Plane.
-
-### Example Manifest
-
-```yaml
-apiVersion: harmony.io/v1alpha1
-kind: MultisitePostgreSQL
-metadata:
-  name: finance-db
-  namespace: tenant-a
-spec:
-  version: "15"
-  storage: "10Gi"
-  resources:
-    requests:
-      cpu: "500m"
-      memory: "1Gi"
-  
-  # Topology Definition
-  topology:
-    primary:
-      site: "site-paris" # The name of the cluster in Harmony
-    replicas:
-      - site: "site-newyork"
-```
-
-### What happens next?
-1.  Harmony detects the CR.
-2.  **On Site Paris:** It deploys a CNPG Cluster (Primary) and creates a Passthrough Route `postgres-finance-db.apps.site-paris.example.com`.
-3.  **On Site New York:** It deploys a CNPG Cluster (Replica) configured with `externalClusters` pointing to the Paris Route.
-4.  Data begins replicating immediately over the encrypted channel.
-
-## 5. Troubleshooting
-
-*   **Connection Refused:** Ensure the Primary site's Route is successfully admitted by the Ingress Controller.
-*   **Certificate Errors:** CNPG manages mTLS automatically. If errors persist, ensure the CA secrets were correctly propagated by Harmony from Primary to Replica namespaces.
--- a/examples/nanodc/src/main.rs
+++ b/examples/nanodc/src/main.rs
@@ -1,6 +1,6 @@
 use std::{
    net::{IpAddr, Ipv4Addr},
-    sync::{Arc, OnceLock},
+    sync::Arc,
 };

 use brocade::BrocadeOptions;
@@ -106,8 +106,8 @@ async fn main() {
                name: "wk2".to_string(),
            },
        ],
+        node_exporter: opnsense.clone(),
        switch_client: switch_client.clone(),
-        network_manager: OnceLock::new(),
    };

    let inventory = Inventory {
--- a/examples/okd_installation/src/topology.rs
+++ b/examples/okd_installation/src/topology.rs
@@ -9,10 +9,7 @@ use harmony::{
 use harmony_macros::{ip, ipv4};
 use harmony_secret::{Secret, SecretManager};
 use serde::{Deserialize, Serialize};
-use std::{
-    net::IpAddr,
-    sync::{Arc, OnceLock},
-};
+use std::{net::IpAddr, sync::Arc};

 #[derive(Secret, Serialize, Deserialize, Debug, PartialEq)]
 struct OPNSenseFirewallConfig {
@@ -83,8 +80,8 @@ pub async fn get_topology() -> HAClusterTopology {
            name: "bootstrap".to_string(),
        },
        workers: vec![],
+        node_exporter: opnsense.clone(),
        switch_client: switch_client.clone(),
-        network_manager: OnceLock::new(),
    }
 }

--- a/examples/okd_pxe/src/topology.rs
+++ b/examples/okd_pxe/src/topology.rs
@@ -10,10 +10,7 @@ use harmony::{
 use harmony_macros::{ip, ipv4};
 use harmony_secret::{Secret, SecretManager};
 use serde::{Deserialize, Serialize};
-use std::{
-    net::IpAddr,
-    sync::{Arc, OnceLock},
-};
+use std::{net::IpAddr, sync::Arc};

 pub async fn get_topology() -> HAClusterTopology {
    let firewall = harmony::topology::LogicalHost {
@@ -78,8 +75,8 @@ pub async fn get_topology() -> HAClusterTopology {
            name: "cp0".to_string(),
        },
        workers: vec![],
+        node_exporter: opnsense.clone(),
        switch_client: switch_client.clone(),
-        network_manager: OnceLock::new(),
    }
 }

--- a/examples/opnsense/src/main.rs
+++ b/examples/opnsense/src/main.rs
@@ -1,6 +1,6 @@
 use std::{
    net::{IpAddr, Ipv4Addr},
-    sync::{Arc, OnceLock},
+    sync::Arc,
 };

 use brocade::BrocadeOptions;
@@ -78,8 +78,8 @@ async fn main() {
            name: "cp0".to_string(),
        },
        workers: vec![],
+        node_exporter: opnsense.clone(),
        switch_client: switch_client.clone(),
-        network_manager: OnceLock::new(),
    };

    let inventory = Inventory {
--- a/examples/opnsense_node_exporter/Cargo.toml
+++ b/examples/opnsense_node_exporter/Cargo.toml
@@ -0,0 +1,21 @@
+[package]
+name = "example-opnsense-node-exporter"
+edition = "2024"
+version.workspace = true
+readme.workspace = true
+license.workspace = true
+
+[dependencies]
+harmony = { path = "../../harmony" }
+harmony_cli = { path = "../../harmony_cli" }
+harmony_types = { path = "../../harmony_types" }
+harmony_secret = { path = "../../harmony_secret" }
+harmony_secret_derive = { path = "../../harmony_secret_derive" }
+cidr = { workspace = true }
+tokio = { workspace = true }
+harmony_macros = { path = "../../harmony_macros" }
+log = { workspace = true }
+env_logger = { workspace = true }
+url = { workspace = true }
+serde.workspace = true
+async-trait.workspace = true
--- a/examples/opnsense_node_exporter/src/main.rs
+++ b/examples/opnsense_node_exporter/src/main.rs
@@ -0,0 +1,79 @@
+use std::{
+    net::{IpAddr, Ipv4Addr},
+    sync::Arc,
+};
+
+use async_trait::async_trait;
+use cidr::Ipv4Cidr;
+use harmony::{
+    executors::ExecutorError,
+    hardware::{HostCategory, Location, PhysicalHost, SwitchGroup},
+    infra::opnsense::OPNSenseManagementInterface,
+    inventory::Inventory,
+    modules::opnsense::node_exporter::NodeExporterScore,
+    topology::{
+        HAClusterTopology, LogicalHost, PreparationError, PreparationOutcome, Topology,
+        UnmanagedRouter, node_exporter::NodeExporter,
+    },
+};
+use harmony_macros::{ip, ipv4, mac_address};
+
+struct OpnSenseTopology {
+    node_exporter: Arc<dyn NodeExporter>,
+}
+
+#[async_trait]
+impl Topology for OpnSenseTopology {
+    async fn ensure_ready(&self) -> Result<PreparationOutcome, PreparationError> {
+        Ok(PreparationOutcome::Success {
+            details: "Success".to_string(),
+        })
+    }
+    fn name(&self) -> &str {
+        "OpnsenseTopology"
+    }
+}
+
+#[async_trait]
+impl NodeExporter for OpnSenseTopology {
+    async fn ensure_initialized(&self) -> Result<(), ExecutorError> {
+        self.node_exporter.ensure_initialized().await
+    }
+
+    async fn commit_config(&self) -> Result<(), ExecutorError> {
+        self.node_exporter.commit_config().await
+    }
+
+    async fn reload_restart(&self) -> Result<(), ExecutorError> {
+        self.node_exporter.reload_restart().await
+    }
+}
+
+#[tokio::main]
+async fn main() {
+    let firewall = harmony::topology::LogicalHost {
+        ip: ip!("192.168.1.1"),
+        name: String::from("fw0"),
+    };
+
+    let opnsense = Arc::new(
+        harmony::infra::opnsense::OPNSenseFirewall::new(firewall, None, "root", "opnsense").await,
+    );
+
+    let topology = OpnSenseTopology {
+        node_exporter: opnsense.clone(),
+    };
+
+    let inventory = Inventory::empty();
+
+    let node_exporter_score = NodeExporterScore {};
+
+    harmony_cli::run(
+        inventory,
+        topology,
+        vec![Box::new(node_exporter_score)],
+        None,
+    )
+    .await
+    .unwrap();
+}
--- a/harmony/src/domain/topology/failover.rs
+++ b/harmony/src/domain/topology/failover.rs
@@ -1,141 +0,0 @@
-use async_trait::async_trait;
-
-use log::{debug, info};
-use std::collections::HashMap;
-
-use crate::{
-    modules::postgresql::capability::{
-        BootstrapConfig, BootstrapStrategy, ExternalClusterConfig, PostgreSQL,
-        PostgreSQLClusterRole, PostgreSQLConfig, PostgreSQLEndpoint, ReplicaConfig,
-        ReplicationCerts,
-    },
-    topology::{PreparationError, PreparationOutcome, Topology},
-};
-
-pub struct FailoverTopology<T> {
-    primary: T,
-    replica: T,
-}
-
-#[async_trait]
-impl<T: Send + Sync> Topology for FailoverTopology<T> {
-    fn name(&self) -> &str {
-        "FailoverTopology"
-    }
-
-    async fn ensure_ready(&self) -> Result<PreparationOutcome, PreparationError> {
-        todo!()
-    }
-}
-
-#[async_trait]
-impl<T: PostgreSQL> PostgreSQL for FailoverTopology<T> {
-    async fn deploy(&self, config: &PostgreSQLConfig) -> Result<String, String> {
-        info!(
-            "Starting deployment of failover topology '{}'",
-            config.cluster_name
-        );
-
-        let primary_config = PostgreSQLConfig {
-            cluster_name: config.cluster_name.clone(),
-            instances: config.instances,
-            storage_size: config.storage_size.clone(),
-            role: PostgreSQLClusterRole::Primary,
-        };
-
-        info!(
-            "Deploying primary cluster '{{}}' ({} instances, {:?} storage)",
-            primary_config.cluster_name, primary_config.storage_size
-        );
-
-        let primary_cluster_name = self.primary.deploy(&primary_config).await?;
-
-        info!("Primary cluster '{primary_cluster_name}' deployed successfully");
-
-        info!("Retrieving replication certificates for primary '{primary_cluster_name}'");
-
-        let certs = self
-            .primary
-            .get_replication_certs(&primary_cluster_name)
-            .await?;
-
-        info!("Replication certificates retrieved successfully");
-
-        info!("Retrieving public endpoint for primary '{primary_cluster_name}");
-
-        let endpoint = self
-            .primary
-            .get_public_endpoint(&primary_cluster_name)
-            .await?
-            .ok_or_else(|| "No public endpoint configured on primary cluster".to_string())?;
-
-        info!(
-            "Public endpoint '{}:{}' retrieved for primary",
-            endpoint.host, endpoint.port
-        );
-
-        info!("Configuring replica connection parameters and bootstrap");
-
-        let mut connection_parameters = HashMap::new();
-        connection_parameters.insert("host".to_string(), endpoint.host);
-        connection_parameters.insert("port".to_string(), endpoint.port.to_string());
-        connection_parameters.insert("dbname".to_string(), "postgres".to_string());
-        connection_parameters.insert("user".to_string(), "streaming_replica".to_string());
-        connection_parameters.insert("sslmode".to_string(), "verify-ca".to_string());
-        connection_parameters.insert("sslnegotiation".to_string(), "direct".to_string());
-
-        debug!("Replica connection parameters: {:?}", connection_parameters);
-
-        let external_cluster = ExternalClusterConfig {
-            name: primary_cluster_name.clone(),
-            connection_parameters,
-        };
-
-        let bootstrap_config = BootstrapConfig {
-            strategy: BootstrapStrategy::PgBasebackup,
-        };
-
-        let replica_cluster_config = ReplicaConfig {
-            primary_cluster_name: primary_cluster_name.clone(),
-            replication_certs: certs,
-            bootstrap: bootstrap_config,
-            external_cluster,
-        };
-
-        let replica_config = PostgreSQLConfig {
-            cluster_name: format!("{}-replica", primary_cluster_name),
-            instances: config.instances,
-            storage_size: config.storage_size.clone(),
-            role: PostgreSQLClusterRole::Replica(replica_cluster_config),
-        };
-
-        info!(
-            "Deploying replica cluster '{}' ({} instances, {:?} storage) on replica topology",
-            replica_config.cluster_name, replica_config.instances, replica_config.storage_size
-        );
-
-        self.replica.deploy(&replica_config).await?;
-
-        info!(
-            "Replica cluster '{}' deployed successfully; failover topology '{}' ready",
-            replica_config.cluster_name, config.cluster_name
-        );
-
-        Ok(primary_cluster_name)
-    }
-
-    async fn get_replication_certs(&self, cluster_name: &str) -> Result<ReplicationCerts, String> {
-        self.primary.get_replication_certs(cluster_name).await
-    }
-
-    async fn get_endpoint(&self, cluster_name: &str) -> Result<PostgreSQLEndpoint, String> {
-        self.primary.get_endpoint(cluster_name).await
-    }
-
-    async fn get_public_endpoint(
-        &self,
-        cluster_name: &str,
-    ) -> Result<Option<PostgreSQLEndpoint>, String> {
-        self.primary.get_public_endpoint(cluster_name).await
-    }
-}
--- a/harmony/src/domain/topology/ha_cluster.rs
+++ b/harmony/src/domain/topology/ha_cluster.rs
@@ -1,25 +1,32 @@
 use async_trait::async_trait;
 use harmony_macros::ip;
 use harmony_types::{
-    id::Id,
    net::{MacAddress, Url},
    switch::PortLocation,
 };
+use kube::api::ObjectMeta;
 use log::debug;
 use log::info;

-use crate::infra::network_manager::OpenShiftNmStateNetworkManager;
 use crate::topology::PxeOptions;
-use crate::{data::FileContent, executors::ExecutorError};
+use crate::{data::FileContent, modules::okd::crd::nmstate::NMState};
+use crate::{
+    executors::ExecutorError, modules::okd::crd::nmstate::NodeNetworkConfigurationPolicySpec,
+};
+use crate::{
+    modules::okd::crd::nmstate::{self, NodeNetworkConfigurationPolicy},
+    topology::node_exporter::NodeExporter,
+};

 use super::{
    DHCPStaticEntry, DhcpServer, DnsRecord, DnsRecordType, DnsServer, Firewall, HostNetworkConfig,
-    HttpServer, IpAddress, K8sclient, LoadBalancer, LoadBalancerService, LogicalHost, NetworkError,
-    NetworkManager, PreparationError, PreparationOutcome, Router, Switch, SwitchClient,
-    SwitchError, TftpServer, Topology, k8s::K8sClient,
+    HttpServer, IpAddress, K8sclient, LoadBalancer, LoadBalancerService, LogicalHost,
+    PreparationError, PreparationOutcome, Router, Switch, SwitchClient, SwitchError, TftpServer,
+    Topology, k8s::K8sClient,
 };

-use std::sync::{Arc, OnceLock};
+use std::collections::BTreeMap;
+use std::sync::Arc;

 #[derive(Debug, Clone)]
 pub struct HAClusterTopology {
@@ -31,12 +38,12 @@ pub struct HAClusterTopology {
    pub tftp_server: Arc<dyn TftpServer>,
    pub http_server: Arc<dyn HttpServer>,
    pub dns_server: Arc<dyn DnsServer>,
+    pub node_exporter: Arc<dyn NodeExporter>,
    pub switch_client: Arc<dyn SwitchClient>,
    pub bootstrap_host: LogicalHost,
    pub control_plane: Vec<LogicalHost>,
    pub workers: Vec<LogicalHost>,
    pub kubeconfig: Option<String>,
-    pub network_manager: OnceLock<Arc<dyn NetworkManager>>,
 }

 #[async_trait]
@@ -60,7 +67,7 @@ impl K8sclient for HAClusterTopology {
                K8sClient::try_default().await.map_err(|e| e.to_string())?,
            )),
            Some(kubeconfig) => {
-                let Some(client) = K8sClient::from_kubeconfig(kubeconfig).await else {
+                let Some(client) = K8sClient::from_kubeconfig(&kubeconfig).await else {
                    return Err("Failed to create k8s client".to_string());
                };
                Ok(Arc::new(client))
@@ -90,12 +97,191 @@ impl HAClusterTopology {
            .to_string()
    }

-    pub async fn network_manager(&self) -> &dyn NetworkManager {
-        let k8s_client = self.k8s_client().await.unwrap();
+    async fn ensure_nmstate_operator_installed(&self) -> Result<(), String> {
+        let k8s_client = self.k8s_client().await?;

-        self.network_manager
-            .get_or_init(|| Arc::new(OpenShiftNmStateNetworkManager::new(k8s_client.clone())))
-            .as_ref()
+        debug!("Installing NMState controller...");
+        k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/nmstate.io_nmstates.yaml
+").unwrap(), Some("nmstate"))
+            .await
+            .map_err(|e| e.to_string())?;
+
+        debug!("Creating NMState namespace...");
+        k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/namespace.yaml
+").unwrap(), Some("nmstate"))
+            .await
+            .map_err(|e| e.to_string())?;
+
+        debug!("Creating NMState service account...");
+        k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/service_account.yaml
+").unwrap(), Some("nmstate"))
+            .await
+            .map_err(|e| e.to_string())?;
+
+        debug!("Creating NMState role...");
+        k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/role.yaml
+").unwrap(), Some("nmstate"))
+            .await
+            .map_err(|e| e.to_string())?;
+
+        debug!("Creating NMState role binding...");
+        k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/role_binding.yaml
+").unwrap(), Some("nmstate"))
+            .await
+            .map_err(|e| e.to_string())?;
+
+        debug!("Creating NMState operator...");
+        k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/operator.yaml
+").unwrap(), Some("nmstate"))
+            .await
+            .map_err(|e| e.to_string())?;
+
+        k8s_client
+            .wait_until_deployment_ready("nmstate-operator", Some("nmstate"), None)
+            .await?;
+
+        let nmstate = NMState {
+            metadata: ObjectMeta {
+                name: Some("nmstate".to_string()),
+                ..Default::default()
+            },
+            ..Default::default()
+        };
+        debug!("Creating NMState: {nmstate:#?}");
+        k8s_client
+            .apply(&nmstate, None)
+            .await
+            .map_err(|e| e.to_string())?;
+
+        Ok(())
+    }
+
+    fn get_next_bond_id(&self) -> u8 {
+        42 // FIXME: Find a better way to declare the bond id
+    }
+
+    async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), SwitchError> {
+        self.ensure_nmstate_operator_installed()
+            .await
+            .map_err(|e| {
+                SwitchError::new(format!(
+                    "Can't configure bond, NMState operator not available: {e}"
+                ))
+            })?;
+
+        let bond_config = self.create_bond_configuration(config);
+        debug!(
+            "Applying NMState bond config for host {}: {bond_config:#?}",
+            config.host_id
+        );
+        self.k8s_client()
+            .await
+            .unwrap()
+            .apply(&bond_config, None)
+            .await
+            .map_err(|e| SwitchError::new(format!("Failed to configure bond: {e}")))?;
+
+        Ok(())
+    }
+
+    fn create_bond_configuration(
+        &self,
+        config: &HostNetworkConfig,
+    ) -> NodeNetworkConfigurationPolicy {
+        let host_name = &config.host_id;
+        let bond_id = self.get_next_bond_id();
+        let bond_name = format!("bond{bond_id}");
+
+        info!("Configuring bond '{bond_name}' for host '{host_name}'...");
+
+        let mut bond_mtu: Option<u32> = None;
+        let mut copy_mac_from: Option<String> = None;
+        let mut bond_ports = Vec::new();
+        let mut interfaces: Vec<nmstate::InterfaceSpec> = Vec::new();
+
+        for switch_port in &config.switch_ports {
+            let interface_name = switch_port.interface.name.clone();
+
+            interfaces.push(nmstate::InterfaceSpec {
+                name: interface_name.clone(),
+                description: Some(format!("Member of bond {bond_name}")),
+                r#type: "ethernet".to_string(),
+                state: "up".to_string(),
+                mtu: Some(switch_port.interface.mtu),
+                mac_address: Some(switch_port.interface.mac_address.to_string()),
+                ipv4: Some(nmstate::IpStackSpec {
+                    enabled: Some(false),
+                    ..Default::default()
+                }),
+                ipv6: Some(nmstate::IpStackSpec {
+                    enabled: Some(false),
+                    ..Default::default()
+                }),
+                link_aggregation: None,
+                ..Default::default()
+            });
+
+            bond_ports.push(interface_name.clone());
+
+            // Use the first port's details for the bond mtu and mac address
+            if bond_mtu.is_none() {
+                bond_mtu = Some(switch_port.interface.mtu);
+            }
+            if copy_mac_from.is_none() {
+                copy_mac_from = Some(interface_name);
+            }
+        }
+
+        interfaces.push(nmstate::InterfaceSpec {
+            name: bond_name.clone(),
+            description: Some(format!("Network bond for host {host_name}")),
+            r#type: "bond".to_string(),
+            state: "up".to_string(),
+            copy_mac_from,
+            ipv4: Some(nmstate::IpStackSpec {
+                dhcp: Some(true),
+                enabled: Some(true),
+                ..Default::default()
+            }),
+            ipv6: Some(nmstate::IpStackSpec {
+                dhcp: Some(true),
+                autoconf: Some(true),
+                enabled: Some(true),
+                ..Default::default()
+            }),
+            link_aggregation: Some(nmstate::BondSpec {
+                mode: "802.3ad".to_string(),
+                ports: bond_ports,
+                ..Default::default()
+            }),
+            ..Default::default()
+        });
+
+        NodeNetworkConfigurationPolicy {
+            metadata: ObjectMeta {
+                name: Some(format!("{host_name}-bond-config")),
+                ..Default::default()
+            },
+            spec: NodeNetworkConfigurationPolicySpec {
+                node_selector: Some(BTreeMap::from([(
+                    "kubernetes.io/hostname".to_string(),
+                    host_name.to_string(),
+                )])),
+                desired_state: nmstate::DesiredStateSpec { interfaces },
+            },
+        }
+    }
+
+    async fn configure_port_channel(&self, config: &HostNetworkConfig) -> Result<(), SwitchError> {
+        debug!("Configuring port channel: {config:#?}");
+        let switch_ports = config.switch_ports.iter().map(|s| s.port.clone()).collect();
+
+        self.switch_client
+            .configure_port_channel(&format!("Harmony_{}", config.host_id), switch_ports)
+            .await
+            .map_err(|e| SwitchError::new(format!("Failed to configure switch: {e}")))?;
+
+        Ok(())
    }

    pub fn autoload() -> Self {
@@ -115,11 +301,11 @@ impl HAClusterTopology {
            tftp_server: dummy_infra.clone(),
            http_server: dummy_infra.clone(),
            dns_server: dummy_infra.clone(),
+            node_exporter: dummy_infra.clone(),
            switch_client: dummy_infra.clone(),
            bootstrap_host: dummy_host,
            control_plane: vec![],
            workers: vec![],
-            network_manager: OnceLock::new(),
        }
    }
 }
@@ -277,40 +463,38 @@ impl HttpServer for HAClusterTopology {
 #[async_trait]
 impl Switch for HAClusterTopology {
    async fn setup_switch(&self) -> Result<(), SwitchError> {
-        self.switch_client.setup().await.map(|_| ())
+        self.switch_client.setup().await?;
+        Ok(())
    }

    async fn get_port_for_mac_address(
        &self,
        mac_address: &MacAddress,
    ) -> Result<Option<PortLocation>, SwitchError> {
-        self.switch_client.find_port(mac_address).await
+        let port = self.switch_client.find_port(mac_address).await?;
+        Ok(port)
    }

-    async fn configure_port_channel(&self, config: &HostNetworkConfig) -> Result<(), SwitchError> {
-        debug!("Configuring port channel: {config:#?}");
-        let switch_ports = config.switch_ports.iter().map(|s| s.port.clone()).collect();
-
-        self.switch_client
-            .configure_port_channel(&format!("Harmony_{}", config.host_id), switch_ports)
-            .await
-            .map_err(|e| SwitchError::new(format!("Failed to configure port-channel: {e}")))?;
-
-        Ok(())
+    async fn configure_host_network(&self, config: &HostNetworkConfig) -> Result<(), SwitchError> {
+        self.configure_bond(config).await?;
+        self.configure_port_channel(config).await
    }
+
+    //TODO add snmp here
 }

 #[async_trait]
-impl NetworkManager for HAClusterTopology {
-    async fn ensure_network_manager_installed(&self) -> Result<(), NetworkError> {
-        self.network_manager()
-            .await
-            .ensure_network_manager_installed()
-            .await
+impl NodeExporter for HAClusterTopology {
+    async fn ensure_initialized(&self) -> Result<(), ExecutorError> {
+        self.node_exporter.ensure_initialized().await
    }

-    async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), NetworkError> {
-        self.network_manager().await.configure_bond(config).await
+    async fn commit_config(&self) -> Result<(), ExecutorError> {
+        self.node_exporter.commit_config().await
+    }
+
+    async fn reload_restart(&self) -> Result<(), ExecutorError> {
+        self.node_exporter.reload_restart().await
    }
 }

@@ -501,6 +685,21 @@ impl DnsServer for DummyInfra {
    }
 }

+#[async_trait]
+impl NodeExporter for DummyInfra {
+    async fn ensure_initialized(&self) -> Result<(), ExecutorError> {
+        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
+    }
+
+    async fn commit_config(&self) -> Result<(), ExecutorError> {
+        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
+    }
+
+    async fn reload_restart(&self) -> Result<(), ExecutorError> {
+        unimplemented!("{}", UNIMPLEMENTED_DUMMY_INFRA)
+    }
+}
+
 #[async_trait]
 impl SwitchClient for DummyInfra {
    async fn setup(&self) -> Result<(), SwitchError> {
--- a/harmony/src/domain/topology/k8s.rs
+++ b/harmony/src/domain/topology/k8s.rs
@@ -5,15 +5,13 @@ use k8s_openapi::{
    ClusterResourceScope, NamespaceResourceScope,
    api::{
        apps::v1::Deployment,
-        core::v1::{Node, Pod, ServiceAccount},
+        core::v1::{Pod, ServiceAccount},
    },
    apimachinery::pkg::version::Info,
 };
 use kube::{
    Client, Config, Discovery, Error, Resource,
-    api::{
-        Api, AttachParams, DeleteParams, ListParams, ObjectList, Patch, PatchParams, ResourceExt,
-    },
+    api::{Api, AttachParams, DeleteParams, ListParams, Patch, PatchParams, ResourceExt},
    config::{KubeConfigOptions, Kubeconfig},
    core::ErrorResponse,
    discovery::{ApiCapabilities, Scope},
@@ -25,7 +23,7 @@ use kube::{
    api::{ApiResource, GroupVersionKind},
    runtime::wait::await_condition,
 };
-use log::{debug, error, trace, warn};
+use log::{debug, error, info, trace, warn};
 use serde::{Serialize, de::DeserializeOwned};
 use serde_json::json;
 use similar::TextDiff;
@@ -566,58 +564,7 @@ impl K8sClient {
        Ok(())
    }

-    /// Gets a single named resource of a specific type `K`.
-    ///
-    /// This function uses the `ApplyStrategy` trait to correctly determine
-    /// whether to look in a specific namespace or in the entire cluster.
-    ///
-    /// Returns `Ok(None)` if the resource is not found (404).
-    pub async fn get_resource<K>(
-        &self,
-        name: &str,
-        namespace: Option<&str>,
-    ) -> Result<Option<K>, Error>
-    where
-        K: Resource + Clone + std::fmt::Debug + DeserializeOwned,
-        <K as Resource>::Scope: ApplyStrategy<K>,
-        <K as kube::Resource>::DynamicType: Default,
-    {
-        let api: Api<K> =
-            <<K as Resource>::Scope as ApplyStrategy<K>>::get_api(&self.client, namespace);
-
-        api.get_opt(name).await
-    }
-
-    /// Lists all resources of a specific type `K`.
-    ///
-    /// This function uses the `ApplyStrategy` trait to correctly determine
-    /// whether to list from a specific namespace or from the entire cluster.
-    pub async fn list_resources<K>(
-        &self,
-        namespace: Option<&str>,
-        list_params: Option<ListParams>,
-    ) -> Result<ObjectList<K>, Error>
-    where
-        K: Resource + Clone + std::fmt::Debug + DeserializeOwned,
-        <K as Resource>::Scope: ApplyStrategy<K>,
-        <K as kube::Resource>::DynamicType: Default,
-    {
-        let api: Api<K> =
-            <<K as Resource>::Scope as ApplyStrategy<K>>::get_api(&self.client, namespace);
-
-        let list_params = list_params.unwrap_or_default();
-        api.list(&list_params).await
-    }
-
-    /// Fetches a list of all Nodes in the cluster.
-    pub async fn get_nodes(
-        &self,
-        list_params: Option<ListParams>,
-    ) -> Result<ObjectList<Node>, Error> {
-        self.list_resources(None, list_params).await
-    }
-
-    pub async fn from_kubeconfig(path: &str) -> Option<K8sClient> {
+    pub(crate) async fn from_kubeconfig(path: &str) -> Option<K8sClient> {
        let k = match Kubeconfig::read_from(path) {
            Ok(k) => k,
            Err(e) => {
--- a/harmony/src/domain/topology/mod.rs
+++ b/harmony/src/domain/topology/mod.rs
@@ -1,7 +1,6 @@
 mod ha_cluster;
 pub mod ingress;
-mod failover;
-pub use failover::*;
+pub mod node_exporter;
 use harmony_types::net::IpAddress;
 mod host_binding;
 mod http;
--- a/harmony/src/domain/topology/network.rs
+++ b/harmony/src/domain/topology/network.rs
@@ -15,7 +15,7 @@ use harmony_types::{
 };
 use serde::Serialize;

-use crate::executors::ExecutorError;
+use crate::{executors::ExecutorError, hardware::PhysicalHost};

 use super::{LogicalHost, k8s::K8sClient};

@@ -183,37 +183,6 @@ impl FromStr for DnsRecordType {
    }
 }

-#[async_trait]
-pub trait NetworkManager: Debug + Send + Sync {
-    async fn ensure_network_manager_installed(&self) -> Result<(), NetworkError>;
-    async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), NetworkError>;
-}
-
-#[derive(Debug, Clone, new)]
-pub struct NetworkError {
-    msg: String,
-}
-
-impl fmt::Display for NetworkError {
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        f.write_str(&self.msg)
-    }
-}
-
-impl Error for NetworkError {}
-
-impl From<kube::Error> for NetworkError {
-    fn from(value: kube::Error) -> Self {
-        NetworkError::new(value.to_string())
-    }
-}
-
-impl From<String> for NetworkError {
-    fn from(value: String) -> Self {
-        NetworkError::new(value)
-    }
-}
-
 #[async_trait]
 pub trait Switch: Send + Sync {
    async fn setup_switch(&self) -> Result<(), SwitchError>;
@@ -223,7 +192,7 @@ pub trait Switch: Send + Sync {
        mac_address: &MacAddress,
    ) -> Result<Option<PortLocation>, SwitchError>;

-    async fn configure_port_channel(&self, config: &HostNetworkConfig) -> Result<(), SwitchError>;
+    async fn configure_host_network(&self, config: &HostNetworkConfig) -> Result<(), SwitchError>;
 }

 #[derive(Clone, Debug, PartialEq)]
--- a/harmony/src/domain/topology/node_exporter.rs
+++ b/harmony/src/domain/topology/node_exporter.rs
@@ -0,0 +1,17 @@
+use async_trait::async_trait;
+
+use crate::executors::ExecutorError;
+
+#[async_trait]
+pub trait NodeExporter: Send + Sync {
+    async fn ensure_initialized(&self) -> Result<(), ExecutorError>;
+    async fn commit_config(&self) -> Result<(), ExecutorError>;
+    async fn reload_restart(&self) -> Result<(), ExecutorError>;
+}
+
+//TODO complete this impl
+impl std::fmt::Debug for dyn NodeExporter {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.write_fmt(format_args!("NodeExporter ",))
+    }
+}
--- a/harmony/src/infra/kube.rs
+++ b/harmony/src/infra/kube.rs
@@ -1,182 +0,0 @@
-use k8s_openapi::Resource as K8sResource;
-use kube::api::{ApiResource, DynamicObject, GroupVersionKind};
-use kube::core::TypeMeta;
-use serde::Serialize;
-use serde::de::DeserializeOwned;
-use serde_json::Value;
-
-/// Convert a typed Kubernetes resource `K` into a `DynamicObject`.
-///
-/// Requirements:
-/// - `K` must be a k8s_openapi resource (provides static GVK via `Resource`).
-/// - `K` must have standard Kubernetes shape (metadata + payload fields).
-///
-/// Notes:
-/// - We set `types` (apiVersion/kind) and copy `metadata`.
-/// - We place the remaining top-level fields into `obj.data` as JSON.
-/// - Scope is not encoded on the object itself; you still need the corresponding
-///   `DynamicResource` (derived from K::group/version/kind) when constructing an Api.
-///
-/// Example usage:
-///   let dyn_obj = kube_resource_to_dynamic(secret)?;
-///   let api: Api<DynamicObject> = Api::namespaced_with(client, "ns", &dr);
-///   api.patch(&dyn_obj.name_any(), &PatchParams::apply("mgr"), &Patch::Apply(dyn_obj)).await?;
-pub fn kube_resource_to_dynamic<K>(res: &K) -> Result<DynamicObject, String>
-where
-    K: K8sResource + Serialize + DeserializeOwned,
-{
-    // Serialize the typed resource to JSON so we can split metadata and payload
-    let mut v = serde_json::to_value(res).map_err(|e| format!("Failed to serialize : {e}"))?;
-    let obj = v
-        .as_object_mut()
-        .ok_or_else(|| "expected object JSON".to_string())?;
-
-    // Extract and parse metadata into kube::core::ObjectMeta
-    let metadata_value = obj
-        .remove("metadata")
-        .ok_or_else(|| "missing metadata".to_string())?;
-    let metadata: kube::core::ObjectMeta = serde_json::from_value(metadata_value)
-        .map_err(|e| format!("Failed to deserialize : {e}"))?;
-
-    // Name is required for DynamicObject::new; prefer metadata.name
-    let name = metadata
-        .name
-        .clone()
-        .ok_or_else(|| "metadata.name is required".to_string())?;
-
-    // Remaining fields (spec/status/data/etc.) become the dynamic payload
-    let payload = Value::Object(obj.clone());
-
-    // Construct the DynamicObject
-    let mut dyn_obj = DynamicObject::new(
-        &name,
-        &ApiResource::from_gvk(&GroupVersionKind::gvk(K::GROUP, K::VERSION, K::KIND)),
-    );
-    dyn_obj.types = Some(TypeMeta {
-        api_version: api_version_for::<K>(),
-        kind: K::KIND.into(),
-    });
-
-    // Preserve namespace/labels/annotations/etc.
-    dyn_obj.metadata = metadata;
-
-    // Attach payload
-    dyn_obj.data = payload;
-
-    Ok(dyn_obj)
-}
-
-/// Helper: compute apiVersion string ("group/version" or "v1" for core).
-fn api_version_for<K>() -> String
-where
-    K: K8sResource,
-{
-    let group = K::GROUP;
-    let version = K::VERSION;
-    if group.is_empty() {
-        version.to_string() // core/v1 => "v1"
-    } else {
-        format!("{}/{}", group, version)
-    }
-}
-#[cfg(test)]
-mod test {
-    use super::*;
-    use k8s_openapi::api::{
-        apps::v1::{Deployment, DeploymentSpec},
-        core::v1::{PodTemplateSpec, Secret},
-    };
-    use kube::api::ObjectMeta;
-    use pretty_assertions::assert_eq;
-
-    #[test]
-    fn secret_to_dynamic_roundtrip() {
-        // Create a sample Secret resource
-        let mut secret = Secret {
-            metadata: ObjectMeta {
-                name: Some("my-secret".to_string()),
-                ..Default::default()
-            },
-            type_: Some("kubernetes.io/service-account-token".to_string()),
-            ..Default::default()
-        };
-
-        // Convert to DynamicResource
-        let dynamic: DynamicObject =
-            kube_resource_to_dynamic(&secret).expect("Failed to convert Secret to DynamicResource");
-
-        // Serialize both the original and dynamic resources to Value
-        let original_value = serde_json::to_value(&secret).expect("Failed to serialize Secret");
-        let dynamic_value =
-            serde_json::to_value(&dynamic).expect("Failed to serialize DynamicResource");
-
-        // Assert that they are identical
-        assert_eq!(original_value, dynamic_value);
-
-        secret.metadata.namespace = Some("false".to_string());
-        let modified_value = serde_json::to_value(&secret).expect("Failed to serialize Secret");
-        assert_ne!(modified_value, dynamic_value);
-    }
-
-    #[test]
-    fn deployment_to_dynamic_roundtrip() {
-        // Create a sample Deployment with nested structures
-        let mut deployment = Deployment {
-            metadata: ObjectMeta {
-                name: Some("my-deployment".to_string()),
-                labels: Some({
-                    let mut map = std::collections::BTreeMap::new();
-                    map.insert("app".to_string(), "nginx".to_string());
-                    map
-                }),
-                ..Default::default()
-            },
-            spec: Some(DeploymentSpec {
-                replicas: Some(3),
-                selector: Default::default(),
-                template: PodTemplateSpec {
-                    metadata: Some(ObjectMeta {
-                        labels: Some({
-                            let mut map = std::collections::BTreeMap::new();
-                            map.insert("app".to_string(), "nginx".to_string());
-                            map
-                        }),
-                        ..Default::default()
-                    }),
-                    spec: Some(Default::default()), // PodSpec with empty containers for simplicity
-                },
-                ..Default::default()
-            }),
-            ..Default::default()
-        };
-
-        let dynamic = kube_resource_to_dynamic(&deployment).expect("Failed to convert Deployment");
-
-        let original_value = serde_json::to_value(&deployment).unwrap();
-        let dynamic_value = serde_json::to_value(&dynamic).unwrap();
-
-        assert_eq!(original_value, dynamic_value);
-
-        assert_eq!(
-            dynamic.data.get("spec").unwrap().get("replicas").unwrap(),
-            3
-        );
-        assert_eq!(
-            dynamic
-                .data
-                .get("spec")
-                .unwrap()
-                .get("template")
-                .unwrap()
-                .get("metadata")
-                .unwrap()
-                .get("labels")
-                .unwrap()
-                .get("app")
-                .unwrap()
-                .as_str()
-                .unwrap(),
-            "nginx".to_string()
-        );
-    }
-}
--- a/harmony/src/infra/mod.rs
+++ b/harmony/src/infra/mod.rs
@@ -3,7 +3,5 @@ pub mod executors;
 pub mod hp_ilo;
 pub mod intel_amt;
 pub mod inventory;
-pub mod kube;
-pub mod network_manager;
 pub mod opnsense;
 mod sqlx;
--- a/harmony/src/infra/network_manager.rs
+++ b/harmony/src/infra/network_manager.rs
@@ -1,257 +0,0 @@
-use std::{
-    collections::{BTreeMap, HashSet},
-    sync::Arc,
-};
-
-use async_trait::async_trait;
-use harmony_types::id::Id;
-use k8s_openapi::api::core::v1::Node;
-use kube::{
-    ResourceExt,
-    api::{ObjectList, ObjectMeta},
-};
-use log::{debug, info};
-
-use crate::{
-    modules::okd::crd::nmstate,
-    topology::{HostNetworkConfig, NetworkError, NetworkManager, k8s::K8sClient},
-};
-
-pub struct OpenShiftNmStateNetworkManager {
-    k8s_client: Arc<K8sClient>,
-}
-
-impl std::fmt::Debug for OpenShiftNmStateNetworkManager {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_struct("OpenShiftNmStateNetworkManager").finish()
-    }
-}
-
-#[async_trait]
-impl NetworkManager for OpenShiftNmStateNetworkManager {
-    async fn ensure_network_manager_installed(&self) -> Result<(), NetworkError> {
-        debug!("Installing NMState controller...");
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/nmstate.io_nmstates.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        debug!("Creating NMState namespace...");
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/namespace.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        debug!("Creating NMState service account...");
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/service_account.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        debug!("Creating NMState role...");
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/role.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        debug!("Creating NMState role binding...");
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/role_binding.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        debug!("Creating NMState operator...");
-        self.k8s_client.apply_url(url::Url::parse("https://github.com/nmstate/kubernetes-nmstate/releases/download/v0.84.0/operator.yaml
-").unwrap(), Some("nmstate"))
-            .await?;
-
-        self.k8s_client
-            .wait_until_deployment_ready("nmstate-operator", Some("nmstate"), None)
-            .await?;
-
-        let nmstate = nmstate::NMState {
-            metadata: ObjectMeta {
-                name: Some("nmstate".to_string()),
-                ..Default::default()
-            },
-            ..Default::default()
-        };
-        debug!(
-            "Creating NMState:\n{}",
-            serde_yaml::to_string(&nmstate).unwrap()
-        );
-        self.k8s_client.apply(&nmstate, None).await?;
-
-        Ok(())
-    }
-
-    async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), NetworkError> {
-        let hostname = self.get_hostname(&config.host_id).await.map_err(|e| {
-            NetworkError::new(format!(
-                "Can't configure bond, can't get hostname for host '{}': {e}",
-                config.host_id
-            ))
-        })?;
-        let bond_id = self.get_next_bond_id(&hostname).await.map_err(|e| {
-            NetworkError::new(format!(
-                "Can't configure bond, can't get an available bond id for host '{}': {e}",
-                config.host_id
-            ))
-        })?;
-        let bond_config = self.create_bond_configuration(&hostname, &bond_id, config);
-
-        debug!(
-            "Applying NMState bond config for host {}:\n{}",
-            config.host_id,
-            serde_yaml::to_string(&bond_config).unwrap(),
-        );
-        self.k8s_client
-            .apply(&bond_config, None)
-            .await
-            .map_err(|e| NetworkError::new(format!("Failed to configure bond: {e}")))?;
-
-        Ok(())
-    }
-}
-
-impl OpenShiftNmStateNetworkManager {
-    pub fn new(k8s_client: Arc<K8sClient>) -> Self {
-        Self { k8s_client }
-    }
-
-    fn create_bond_configuration(
-        &self,
-        host: &str,
-        bond_name: &str,
-        config: &HostNetworkConfig,
-    ) -> nmstate::NodeNetworkConfigurationPolicy {
-        info!("Configuring bond '{bond_name}' for host '{host}'...");
-
-        let mut bond_mtu: Option<u32> = None;
-        let mut copy_mac_from: Option<String> = None;
-        let mut bond_ports = Vec::new();
-        let mut interfaces: Vec<nmstate::Interface> = Vec::new();
-
-        for switch_port in &config.switch_ports {
-            let interface_name = switch_port.interface.name.clone();
-
-            interfaces.push(nmstate::Interface {
-                name: interface_name.clone(),
-                description: Some(format!("Member of bond {bond_name}")),
-                r#type: nmstate::InterfaceType::Ethernet,
-                state: "up".to_string(),
-                ipv4: Some(nmstate::IpStackSpec {
-                    enabled: Some(false),
-                    ..Default::default()
-                }),
-                ipv6: Some(nmstate::IpStackSpec {
-                    enabled: Some(false),
-                    ..Default::default()
-                }),
-                link_aggregation: None,
-                ..Default::default()
-            });
-
-            bond_ports.push(interface_name.clone());
-
-            // Use the first port's details for the bond mtu and mac address
-            if bond_mtu.is_none() {
-                bond_mtu = Some(switch_port.interface.mtu);
-            }
-            if copy_mac_from.is_none() {
-                copy_mac_from = Some(interface_name);
-            }
-        }
-
-        interfaces.push(nmstate::Interface {
-            name: bond_name.to_string(),
-            description: Some(format!("HARMONY - Network bond for host {host}")),
-            r#type: nmstate::InterfaceType::Bond,
-            state: "up".to_string(),
-            copy_mac_from,
-            ipv4: Some(nmstate::IpStackSpec {
-                dhcp: Some(true),
-                enabled: Some(true),
-                ..Default::default()
-            }),
-            ipv6: Some(nmstate::IpStackSpec {
-                dhcp: Some(true),
-                autoconf: Some(true),
-                enabled: Some(true),
-                ..Default::default()
-            }),
-            link_aggregation: Some(nmstate::BondSpec {
-                mode: "802.3ad".to_string(),
-                ports: bond_ports,
-                ..Default::default()
-            }),
-            ..Default::default()
-        });
-
-        nmstate::NodeNetworkConfigurationPolicy {
-            metadata: ObjectMeta {
-                name: Some(format!("{host}-bond-config")),
-                ..Default::default()
-            },
-            spec: nmstate::NodeNetworkConfigurationPolicySpec {
-                node_selector: Some(BTreeMap::from([(
-                    "kubernetes.io/hostname".to_string(),
-                    host.to_string(),
-                )])),
-                desired_state: nmstate::NetworkState {
-                    interfaces,
-                    ..Default::default()
-                },
-            },
-        }
-    }
-
-    async fn get_hostname(&self, host_id: &Id) -> Result<String, String> {
-        let nodes: ObjectList<Node> = self
-            .k8s_client
-            .list_resources(None, None)
-            .await
-            .map_err(|e| format!("Failed to list nodes: {e}"))?;
-
-        let Some(node) = nodes.iter().find(|n| {
-            n.status
-                .as_ref()
-                .and_then(|s| s.node_info.as_ref())
-                .map(|i| i.system_uuid == host_id.to_string())
-                .unwrap_or(false)
-        }) else {
-            return Err(format!("No node found for host '{host_id}'"));
-        };
-
-        node.labels()
-            .get("kubernetes.io/hostname")
-            .ok_or(format!(
-                "Node '{host_id}' has no kubernetes.io/hostname label"
-            ))
-            .cloned()
-    }
-
-    async fn get_next_bond_id(&self, hostname: &str) -> Result<String, String> {
-        let network_state: Option<nmstate::NodeNetworkState> = self
-            .k8s_client
-            .get_resource(hostname, None)
-            .await
-            .map_err(|e| format!("Failed to list nodes: {e}"))?;
-
-        let interfaces = vec![];
-        let existing_bonds: Vec<&nmstate::Interface> = network_state
-            .as_ref()
-            .and_then(|network_state| network_state.status.current_state.as_ref())
-            .map_or(&interfaces, |current_state| &current_state.interfaces)
-            .iter()
-            .filter(|i| i.r#type == nmstate::InterfaceType::Bond)
-            .collect();
-
-        let used_ids: HashSet<u32> = existing_bonds
-            .iter()
-            .filter_map(|i| {
-                i.name
-                    .strip_prefix("bond")
-                    .and_then(|id| id.parse::<u32>().ok())
-            })
-            .collect();
-
-        let next_id = (0..).find(|id| !used_ids.contains(id)).unwrap();
-        Ok(format!("bond{next_id}"))
-    }
-}
--- a/harmony/src/infra/opnsense/mod.rs
+++ b/harmony/src/infra/opnsense/mod.rs
@@ -4,6 +4,7 @@ mod firewall;
 mod http;
 mod load_balancer;
 mod management;
+pub mod node_exporter;
 mod tftp;
 use std::sync::Arc;

--- a/harmony/src/infra/opnsense/node_exporter.rs
+++ b/harmony/src/infra/opnsense/node_exporter.rs
@@ -0,0 +1,47 @@
+use async_trait::async_trait;
+use log::debug;
+
+use crate::{
+    executors::ExecutorError, infra::opnsense::OPNSenseFirewall,
+    topology::node_exporter::NodeExporter,
+};
+
+#[async_trait]
+impl NodeExporter for OPNSenseFirewall {
+    async fn ensure_initialized(&self) -> Result<(), ExecutorError> {
+        let mut config = self.opnsense_config.write().await;
+        let node_exporter = config.node_exporter();
+        if let Some(config) = node_exporter.get_full_config() {
+            debug!(
+                "Node exporter available in opnsense config, assuming it is already installed. {config:?}"
+            );
+        } else {
+            config
+                .install_package("os-node_exporter")
+                .await
+                .map_err(|e| {
+                        ExecutorError::UnexpectedError(format!("Executor failed when trying to install os-node_exporter package with error {e:?}"
+                                ))
+                    })?;
+        }
+
+        config
+            .node_exporter()
+            .enable(true)
+            .map_err(|e| ExecutorError::UnexpectedError(e.to_string()))?;
+        Ok(())
+    }
+    async fn commit_config(&self) -> Result<(), ExecutorError> {
+        OPNSenseFirewall::commit_config(self).await
+    }
+
+    async fn reload_restart(&self) -> Result<(), ExecutorError> {
+        self.opnsense_config
+            .write()
+            .await
+            .node_exporter()
+            .reload_restart()
+            .await
+            .map_err(|e| ExecutorError::UnexpectedError(e.to_string()))
+    }
+}
--- a/harmony/src/modules/inventory/discovery.rs
+++ b/harmony/src/modules/inventory/discovery.rs
@@ -74,11 +74,7 @@ impl<T: Topology> Interpret<T> for DiscoverHostForRoleInterpret {

            match ans {
                Ok(choice) => {
-                    info!(
-                        "Selected {} as the {:?} node.",
-                        choice.summary(),
-                        self.score.role
-                    );
+                    info!("Selected {} as the bootstrap node.", choice.summary());
                    host_repo
                        .save_role_mapping(&self.score.role, &choice)
                        .await?;
@@ -94,7 +90,10 @@ impl<T: Topology> Interpret<T> for DiscoverHostForRoleInterpret {
                        "Failed to select node for role {:?} : {}",
                        self.score.role, e
                    );
-                    return Err(InterpretError::new(format!("Could not select host : {e}")));
+                    return Err(InterpretError::new(format!(
+                        "Could not select host : {}",
+                        e.to_string()
+                    )));
                }
            }
        }
--- a/harmony/src/modules/mod.rs
+++ b/harmony/src/modules/mod.rs
@@ -17,4 +17,3 @@ pub mod prometheus;
 pub mod storage;
 pub mod tenant;
 pub mod tftp;
-pub mod postgresql;
--- a/harmony/src/modules/okd/crd/nmstate.rs
+++ b/harmony/src/modules/okd/crd/nmstate.rs
@@ -1,7 +1,6 @@
 use std::collections::BTreeMap;

-use k8s_openapi::{ClusterResourceScope, Resource};
-use kube::{CustomResource, api::ObjectMeta};
+use kube::CustomResource;
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 use serde_json::Value;
@@ -48,223 +47,28 @@ pub struct ProbeDns {
    group = "nmstate.io",
    version = "v1",
    kind = "NodeNetworkConfigurationPolicy",
-    namespaced = false
+    namespaced
 )]
 #[serde(rename_all = "camelCase")]
 pub struct NodeNetworkConfigurationPolicySpec {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub node_selector: Option<BTreeMap<String, String>>,
-    pub desired_state: NetworkState,
-}
-
-// Currently, kube-rs derive doesn't support resources without a `spec` field, so we have
-// to implement it ourselves.
-//
-// Ref:
-// - https://github.com/kube-rs/kube/issues/1763
-// - https://github.com/kube-rs/kube/discussions/1762
-#[derive(Deserialize, Serialize, Clone, Debug)]
-#[serde(rename_all = "camelCase")]
-pub struct NodeNetworkState {
-    metadata: ObjectMeta,
-    pub status: NodeNetworkStateStatus,
-}
-
-impl Resource for NodeNetworkState {
-    const API_VERSION: &'static str = "nmstate.io/v1beta1";
-    const GROUP: &'static str = "nmstate.io";
-    const VERSION: &'static str = "v1beta1";
-    const KIND: &'static str = "NodeNetworkState";
-    const URL_PATH_SEGMENT: &'static str = "nodenetworkstates";
-    type Scope = ClusterResourceScope;
-}
-
-impl k8s_openapi::Metadata for NodeNetworkState {
-    type Ty = ObjectMeta;
-
-    fn metadata(&self) -> &Self::Ty {
-        &self.metadata
-    }
-
-    fn metadata_mut(&mut self) -> &mut Self::Ty {
-        &mut self.metadata
-    }
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[serde(rename_all = "camelCase")]
-pub struct NodeNetworkStateStatus {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub current_state: Option<NetworkState>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub handler_nmstate_version: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub host_network_manager_version: Option<String>,
-
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub last_successful_update_time: Option<String>,
-}
-
-/// The NetworkState is the top-level struct, representing the entire
-/// desired or current network state.
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-#[serde(deny_unknown_fields)]
-pub struct NetworkState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub hostname: Option<HostNameState>,
-    #[serde(rename = "dns-resolver", skip_serializing_if = "Option::is_none")]
-    pub dns: Option<DnsState>,
-    #[serde(rename = "route-rules", skip_serializing_if = "Option::is_none")]
-    pub rules: Option<RouteRuleState>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub routes: Option<RouteState>,
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub interfaces: Vec<Interface>,
-    #[serde(rename = "ovs-db", skip_serializing_if = "Option::is_none")]
-    pub ovsdb: Option<OvsDbGlobalConfig>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ovn: Option<OvnConfiguration>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct HostNameState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub running: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config: Option<String>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct DnsState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub running: Option<DnsResolverConfig>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config: Option<DnsResolverConfig>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct DnsResolverConfig {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub search: Option<Vec<String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub server: Option<Vec<String>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct RouteRuleState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config: Option<Vec<RouteRule>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub running: Option<Vec<RouteRule>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct RouteState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub config: Option<Vec<Route>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub running: Option<Vec<Route>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct RouteRule {
-    #[serde(rename = "ip-from", skip_serializing_if = "Option::is_none")]
-    pub ip_from: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub priority: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub route_table: Option<u32>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct Route {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub destination: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub metric: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub next_hop_address: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub next_hop_interface: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub table_id: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mtu: Option<u32>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct OvsDbGlobalConfig {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub external_ids: Option<BTreeMap<String, String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub other_config: Option<BTreeMap<String, String>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct OvnConfiguration {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub bridge_mappings: Option<Vec<OvnBridgeMapping>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct OvnBridgeMapping {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub localnet: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub bridge: Option<String>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[serde(untagged)]
-#[serde(rename_all = "kebab-case")]
-pub enum StpSpec {
-    Bool(bool),
-    Options(StpOptions),
+    pub desired_state: DesiredStateSpec,
 }

 #[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
-pub struct LldpState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub enabled: Option<bool>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct OvsDb {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub external_ids: Option<BTreeMap<String, String>>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub other_config: Option<BTreeMap<String, String>>,
-}
-
-#[derive(Deserialize, Serialize, Clone, Debug, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub struct PatchState {
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub peer: Option<String>,
+pub struct DesiredStateSpec {
+    pub interfaces: Vec<InterfaceSpec>,
 }

 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
 #[serde(rename_all = "kebab-case")]
-pub struct Interface {
+pub struct InterfaceSpec {
    pub name: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub description: Option<String>,
-    pub r#type: InterfaceType,
+    pub r#type: String,
    pub state: String,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub mac_address: Option<String>,
@@ -295,81 +99,9 @@ pub struct Interface {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub linux_bridge: Option<LinuxBridgeSpec>,
    #[serde(skip_serializing_if = "Option::is_none")]
-    #[serde(alias = "bridge")]
    pub ovs_bridge: Option<OvsBridgeSpec>,
    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ethtool: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub accept_all_mac_addresses: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub identifier: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub lldp: Option<LldpState>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub permanent_mac_address: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub max_mtu: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub min_mtu: Option<u32>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub mptcp: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub profile_name: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub wait_ip: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub ovs_db: Option<OvsDb>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub driver: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub patch: Option<PatchState>,
-}
-
-#[derive(Deserialize, Serialize, Clone, PartialEq, Eq, PartialOrd, Ord, Debug, JsonSchema)]
-#[serde(rename_all = "kebab-case")]
-pub enum InterfaceType {
-    #[serde(rename = "unknown")]
-    Unknown,
-    #[serde(rename = "dummy")]
-    Dummy,
-    #[serde(rename = "loopback")]
-    Loopback,
-    #[serde(rename = "linux-bridge")]
-    LinuxBridge,
-    #[serde(rename = "ovs-bridge")]
-    OvsBridge,
-    #[serde(rename = "ovs-interface")]
-    OvsInterface,
-    #[serde(rename = "bond")]
-    Bond,
-    #[serde(rename = "ipvlan")]
-    IpVlan,
-    #[serde(rename = "vlan")]
-    Vlan,
-    #[serde(rename = "vxlan")]
-    Vxlan,
-    #[serde(rename = "mac-vlan")]
-    Macvlan,
-    #[serde(rename = "mac-vtap")]
-    Macvtap,
-    #[serde(rename = "ethernet")]
-    Ethernet,
-    #[serde(rename = "infiniband")]
-    Infiniband,
-    #[serde(rename = "vrf")]
-    Vrf,
-    #[serde(rename = "veth")]
-    Veth,
-    #[serde(rename = "ipsec")]
-    Ipsec,
-    #[serde(rename = "hsr")]
-    Hrs,
-}
-
-impl Default for InterfaceType {
-    fn default() -> Self {
-        Self::Loopback
-    }
+    pub ethtool: Option<EthtoolSpec>,
 }

 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
@@ -417,7 +149,6 @@ pub struct EthernetSpec {
 #[serde(rename_all = "kebab-case")]
 pub struct BondSpec {
    pub mode: String,
-    #[serde(alias = "port")]
    pub ports: Vec<String>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub options: Option<BTreeMap<String, Value>>,
@@ -556,15 +287,11 @@ pub struct OvsBridgeSpec {
 #[serde(rename_all = "kebab-case")]
 pub struct OvsBridgeOptions {
    #[serde(skip_serializing_if = "Option::is_none")]
-    pub stp: Option<StpSpec>,
+    pub stp: Option<bool>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub rstp: Option<bool>,
    #[serde(skip_serializing_if = "Option::is_none")]
    pub mcast_snooping_enable: Option<bool>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub datapath: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub fail_mode: Option<String>,
 }

 #[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
@@ -578,3 +305,18 @@ pub struct OvsPortSpec {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub r#type: Option<String>,
 }
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct EthtoolSpec {
+    // TODO: Properly describe this spec (https://nmstate.io/devel/yaml_api.html#ethtool)
+}
+
+#[derive(Deserialize, Serialize, Clone, Debug, Default, JsonSchema)]
+#[serde(rename_all = "kebab-case")]
+pub struct EthtoolFecSpec {
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub auto: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub mode: Option<String>,
+}
--- a/harmony/src/modules/okd/host_network.rs
+++ b/harmony/src/modules/okd/host_network.rs
@@ -1,6 +1,6 @@
 use async_trait::async_trait;
 use harmony_types::id::Id;
-use log::{info, warn};
+use log::{debug, info};
 use serde::Serialize;

 use crate::{
@@ -9,7 +9,7 @@ use crate::{
    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
    inventory::Inventory,
    score::Score,
-    topology::{HostNetworkConfig, NetworkInterface, NetworkManager, Switch, SwitchPort, Topology},
+    topology::{HostNetworkConfig, NetworkInterface, Switch, SwitchPort, Topology},
 };

 #[derive(Debug, Clone, Serialize)]
@@ -17,7 +17,7 @@ pub struct HostNetworkConfigurationScore {
    pub hosts: Vec<PhysicalHost>,
 }

-impl<T: Topology + NetworkManager + Switch> Score<T> for HostNetworkConfigurationScore {
+impl<T: Topology + Switch> Score<T> for HostNetworkConfigurationScore {
    fn name(&self) -> String {
        "HostNetworkConfigurationScore".into()
    }
@@ -35,7 +35,7 @@ pub struct HostNetworkConfigurationInterpret {
 }

 impl HostNetworkConfigurationInterpret {
-    async fn configure_network_for_host<T: Topology + NetworkManager + Switch>(
+    async fn configure_network_for_host<T: Topology + Switch>(
        &self,
        topology: &T,
        host: &PhysicalHost,
@@ -49,13 +49,6 @@ impl HostNetworkConfigurationInterpret {
                switch_ports: vec![],
            });
        }
-        if host.network.len() == 1 {
-            info!("[Host {current_host}/{total_hosts}] Only one interface to configure, skipping");
-            return Ok(HostNetworkConfig {
-                host_id: host.id.clone(),
-                switch_ports: vec![],
-            });
-        }

        let switch_ports = self
            .collect_switch_ports_for_host(topology, host, current_host, total_hosts)
@@ -66,7 +59,7 @@ impl HostNetworkConfigurationInterpret {
            switch_ports,
        };

-        if config.switch_ports.len() > 1 {
+        if !config.switch_ports.is_empty() {
            info!(
                "[Host {current_host}/{total_hosts}] Found {} ports for {} interfaces",
                config.switch_ports.len(),
@@ -74,25 +67,15 @@ impl HostNetworkConfigurationInterpret {
            );

            info!("[Host {current_host}/{total_hosts}] Configuring host network...");
-            topology.configure_bond(&config).await.map_err(|e| {
-                InterpretError::new(format!("Failed to configure host network: {e}"))
-            })?;
            topology
-                .configure_port_channel(&config)
+                .configure_host_network(&config)
                .await
-                .map_err(|e| {
-                    InterpretError::new(format!("Failed to configure host network: {e}"))
-                })?;
-        } else if config.switch_ports.is_empty() {
+                .map_err(|e| InterpretError::new(format!("Failed to configure host: {e}")))?;
+        } else {
            info!(
                "[Host {current_host}/{total_hosts}] No ports found for {} interfaces, skipping",
                host.network.len()
            );
-        } else {
-            warn!(
-                "[Host {current_host}/{total_hosts}] Found a single port for {} interfaces, skipping",
-                host.network.len()
-            );
        }

        Ok(config)
@@ -130,7 +113,7 @@ impl HostNetworkConfigurationInterpret {
                        port,
                    });
                }
-                Ok(None) => {}
+                Ok(None) => debug!("No port found for '{mac_address}', skipping"),
                Err(e) => {
                    return Err(InterpretError::new(format!(
                        "Failed to get port for host '{}': {}",
@@ -150,6 +133,15 @@ impl HostNetworkConfigurationInterpret {
        ];

        for config in configs {
+            let host = self
+                .score
+                .hosts
+                .iter()
+                .find(|h| h.id == config.host_id)
+                .unwrap();
+
+            println!("[Host] {host}");
+
            if config.switch_ports.is_empty() {
                report.push(format!(
                    "⏭️ Host {}: SKIPPED (No matching switch ports found)",
@@ -177,7 +169,7 @@ impl HostNetworkConfigurationInterpret {
 }

 #[async_trait]
-impl<T: Topology + NetworkManager + Switch> Interpret<T> for HostNetworkConfigurationInterpret {
+impl<T: Topology + Switch> Interpret<T> for HostNetworkConfigurationInterpret {
    fn get_name(&self) -> InterpretName {
        InterpretName::Custom("HostNetworkConfigurationInterpret")
    }
@@ -206,12 +198,6 @@ impl<T: Topology + NetworkManager + Switch> Interpret<T> for HostNetworkConfigur
        let host_count = self.score.hosts.len();
        info!("Started network configuration for {host_count} host(s)...",);

-        info!("Setting up NetworkManager...",);
-        topology
-            .ensure_network_manager_installed()
-            .await
-            .map_err(|e| InterpretError::new(format!("NetworkManager setup failed: {e}")))?;
-
        info!("Setting up switch with sane defaults...");
        topology
            .setup_switch()
@@ -230,7 +216,6 @@ impl<T: Topology + NetworkManager + Switch> Interpret<T> for HostNetworkConfigur
            host_configurations.push(host_configuration);
            current_host += 1;
        }
-
        if current_host > 1 {
            let details = self.format_host_configuration(host_configurations);

@@ -257,8 +242,7 @@ mod tests {
    use crate::{
        hardware::HostCategory,
        topology::{
-            HostNetworkConfig, NetworkError, PreparationError, PreparationOutcome, SwitchError,
-            SwitchPort,
+            HostNetworkConfig, PreparationError, PreparationOutcome, SwitchError, SwitchPort,
        },
    };
    use std::{
@@ -283,18 +267,6 @@ mod tests {
            speed_mbps: None,
            mtu: 1,
        };
-        pub static ref YET_ANOTHER_EXISTING_INTERFACE: NetworkInterface = NetworkInterface {
-            mac_address: MacAddress::try_from("AA:BB:CC:DD:EE:F3".to_string()).unwrap(),
-            name: "interface-3".into(),
-            speed_mbps: None,
-            mtu: 1,
-        };
-        pub static ref LAST_EXISTING_INTERFACE: NetworkInterface = NetworkInterface {
-            mac_address: MacAddress::try_from("AA:BB:CC:DD:EE:F4".to_string()).unwrap(),
-            name: "interface-4".into(),
-            speed_mbps: None,
-            mtu: 1,
-        };
        pub static ref UNKNOWN_INTERFACE: NetworkInterface = NetworkInterface {
            mac_address: MacAddress::try_from("11:22:33:44:55:61".to_string()).unwrap(),
            name: "unknown-interface".into(),
@@ -303,8 +275,6 @@ mod tests {
        };
        pub static ref PORT: PortLocation = PortLocation(1, 0, 42);
        pub static ref ANOTHER_PORT: PortLocation = PortLocation(2, 0, 42);
-        pub static ref YET_ANOTHER_PORT: PortLocation = PortLocation(1, 0, 45);
-        pub static ref LAST_PORT: PortLocation = PortLocation(2, 0, 45);
    }

    #[tokio::test]
@@ -320,33 +290,28 @@ mod tests {
    }

    #[tokio::test]
-    async fn should_setup_network_manager() {
+    async fn host_with_one_mac_address_should_create_bond_with_one_interface() {
        let host = given_host(&HOST_ID, vec![EXISTING_INTERFACE.clone()]);
        let score = given_score(vec![host]);
        let topology = TopologyWithSwitch::new();

        let _ = score.interpret(&Inventory::empty(), &topology).await;

-        let network_manager_setup = topology.network_manager_setup.lock().unwrap();
-        assert_that!(*network_manager_setup).is_true();
+        let configured_host_networks = topology.configured_host_networks.lock().unwrap();
+        assert_that!(*configured_host_networks).contains_exactly(vec![(
+            HOST_ID.clone(),
+            HostNetworkConfig {
+                host_id: HOST_ID.clone(),
+                switch_ports: vec![SwitchPort {
+                    interface: EXISTING_INTERFACE.clone(),
+                    port: PORT.clone(),
+                }],
+            },
+        )]);
    }

    #[tokio::test]
-    async fn host_with_one_mac_address_should_skip_host_configuration() {
-        let host = given_host(&HOST_ID, vec![EXISTING_INTERFACE.clone()]);
-        let score = given_score(vec![host]);
-        let topology = TopologyWithSwitch::new();
-
-        let _ = score.interpret(&Inventory::empty(), &topology).await;
-
-        let config = topology.configured_bonds.lock().unwrap();
-        assert_that!(*config).is_empty();
-        let config = topology.configured_port_channels.lock().unwrap();
-        assert_that!(*config).is_empty();
-    }
-
-    #[tokio::test]
-    async fn host_with_multiple_mac_addresses_should_configure_one_bond_with_all_interfaces() {
+    async fn host_with_multiple_mac_addresses_should_create_one_bond_with_all_interfaces() {
        let score = given_score(vec![given_host(
            &HOST_ID,
            vec![
@@ -358,8 +323,8 @@ mod tests {

        let _ = score.interpret(&Inventory::empty(), &topology).await;

-        let config = topology.configured_bonds.lock().unwrap();
-        assert_that!(*config).contains_exactly(vec![(
+        let configured_host_networks = topology.configured_host_networks.lock().unwrap();
+        assert_that!(*configured_host_networks).contains_exactly(vec![(
            HOST_ID.clone(),
            HostNetworkConfig {
                host_id: HOST_ID.clone(),
@@ -378,183 +343,49 @@ mod tests {
    }

    #[tokio::test]
-    async fn host_with_multiple_mac_addresses_should_configure_one_port_channel_with_all_interfaces()
-     {
-        let score = given_score(vec![given_host(
-            &HOST_ID,
-            vec![
-                EXISTING_INTERFACE.clone(),
-                ANOTHER_EXISTING_INTERFACE.clone(),
-            ],
-        )]);
+    async fn multiple_hosts_should_create_one_bond_per_host() {
+        let score = given_score(vec![
+            given_host(&HOST_ID, vec![EXISTING_INTERFACE.clone()]),
+            given_host(&ANOTHER_HOST_ID, vec![ANOTHER_EXISTING_INTERFACE.clone()]),
+        ]);
        let topology = TopologyWithSwitch::new();

        let _ = score.interpret(&Inventory::empty(), &topology).await;

-        let config = topology.configured_port_channels.lock().unwrap();
-        assert_that!(*config).contains_exactly(vec![(
-            HOST_ID.clone(),
-            HostNetworkConfig {
-                host_id: HOST_ID.clone(),
-                switch_ports: vec![
-                    SwitchPort {
+        let configured_host_networks = topology.configured_host_networks.lock().unwrap();
+        assert_that!(*configured_host_networks).contains_exactly(vec![
+            (
+                HOST_ID.clone(),
+                HostNetworkConfig {
+                    host_id: HOST_ID.clone(),
+                    switch_ports: vec![SwitchPort {
                        interface: EXISTING_INTERFACE.clone(),
                        port: PORT.clone(),
-                    },
-                    SwitchPort {
+                    }],
+                },
+            ),
+            (
+                ANOTHER_HOST_ID.clone(),
+                HostNetworkConfig {
+                    host_id: ANOTHER_HOST_ID.clone(),
+                    switch_ports: vec![SwitchPort {
                        interface: ANOTHER_EXISTING_INTERFACE.clone(),
                        port: ANOTHER_PORT.clone(),
-                    },
-                ],
-            },
-        )]);
-    }
-
-    #[tokio::test]
-    async fn multiple_hosts_should_configure_one_bond_per_host() {
-        let score = given_score(vec![
-            given_host(
-                &HOST_ID,
-                vec![
-                    EXISTING_INTERFACE.clone(),
-                    ANOTHER_EXISTING_INTERFACE.clone(),
-                ],
-            ),
-            given_host(
-                &ANOTHER_HOST_ID,
-                vec![
-                    YET_ANOTHER_EXISTING_INTERFACE.clone(),
-                    LAST_EXISTING_INTERFACE.clone(),
-                ],
-            ),
-        ]);
-        let topology = TopologyWithSwitch::new();
-
-        let _ = score.interpret(&Inventory::empty(), &topology).await;
-
-        let config = topology.configured_bonds.lock().unwrap();
-        assert_that!(*config).contains_exactly(vec![
-            (
-                HOST_ID.clone(),
-                HostNetworkConfig {
-                    host_id: HOST_ID.clone(),
-                    switch_ports: vec![
-                        SwitchPort {
-                            interface: EXISTING_INTERFACE.clone(),
-                            port: PORT.clone(),
-                        },
-                        SwitchPort {
-                            interface: ANOTHER_EXISTING_INTERFACE.clone(),
-                            port: ANOTHER_PORT.clone(),
-                        },
-                    ],
-                },
-            ),
-            (
-                ANOTHER_HOST_ID.clone(),
-                HostNetworkConfig {
-                    host_id: ANOTHER_HOST_ID.clone(),
-                    switch_ports: vec![
-                        SwitchPort {
-                            interface: YET_ANOTHER_EXISTING_INTERFACE.clone(),
-                            port: YET_ANOTHER_PORT.clone(),
-                        },
-                        SwitchPort {
-                            interface: LAST_EXISTING_INTERFACE.clone(),
-                            port: LAST_PORT.clone(),
-                        },
-                    ],
+                    }],
                },
            ),
        ]);
    }

    #[tokio::test]
-    async fn multiple_hosts_should_configure_one_port_channel_per_host() {
-        let score = given_score(vec![
-            given_host(
-                &HOST_ID,
-                vec![
-                    EXISTING_INTERFACE.clone(),
-                    ANOTHER_EXISTING_INTERFACE.clone(),
-                ],
-            ),
-            given_host(
-                &ANOTHER_HOST_ID,
-                vec![
-                    YET_ANOTHER_EXISTING_INTERFACE.clone(),
-                    LAST_EXISTING_INTERFACE.clone(),
-                ],
-            ),
-        ]);
-        let topology = TopologyWithSwitch::new();
-
-        let _ = score.interpret(&Inventory::empty(), &topology).await;
-
-        let config = topology.configured_port_channels.lock().unwrap();
-        assert_that!(*config).contains_exactly(vec![
-            (
-                HOST_ID.clone(),
-                HostNetworkConfig {
-                    host_id: HOST_ID.clone(),
-                    switch_ports: vec![
-                        SwitchPort {
-                            interface: EXISTING_INTERFACE.clone(),
-                            port: PORT.clone(),
-                        },
-                        SwitchPort {
-                            interface: ANOTHER_EXISTING_INTERFACE.clone(),
-                            port: ANOTHER_PORT.clone(),
-                        },
-                    ],
-                },
-            ),
-            (
-                ANOTHER_HOST_ID.clone(),
-                HostNetworkConfig {
-                    host_id: ANOTHER_HOST_ID.clone(),
-                    switch_ports: vec![
-                        SwitchPort {
-                            interface: YET_ANOTHER_EXISTING_INTERFACE.clone(),
-                            port: YET_ANOTHER_PORT.clone(),
-                        },
-                        SwitchPort {
-                            interface: LAST_EXISTING_INTERFACE.clone(),
-                            port: LAST_PORT.clone(),
-                        },
-                    ],
-                },
-            ),
-        ]);
-    }
-
-    #[tokio::test]
-    async fn port_not_found_for_mac_address_should_not_configure_host() {
+    async fn port_not_found_for_mac_address_should_not_configure_interface() {
        let score = given_score(vec![given_host(&HOST_ID, vec![UNKNOWN_INTERFACE.clone()])]);
        let topology = TopologyWithSwitch::new_port_not_found();

        let _ = score.interpret(&Inventory::empty(), &topology).await;

-        let config = topology.configured_port_channels.lock().unwrap();
-        assert_that!(*config).is_empty();
-        let config = topology.configured_bonds.lock().unwrap();
-        assert_that!(*config).is_empty();
-    }
-
-    #[tokio::test]
-    async fn only_one_port_found_for_multiple_mac_addresses_should_not_configure_host() {
-        let score = given_score(vec![given_host(
-            &HOST_ID,
-            vec![EXISTING_INTERFACE.clone(), UNKNOWN_INTERFACE.clone()],
-        )]);
-        let topology = TopologyWithSwitch::new_single_port_found();
-
-        let _ = score.interpret(&Inventory::empty(), &topology).await;
-
-        let config = topology.configured_port_channels.lock().unwrap();
-        assert_that!(*config).is_empty();
-        let config = topology.configured_bonds.lock().unwrap();
-        assert_that!(*config).is_empty();
+        let configured_host_networks = topology.configured_host_networks.lock().unwrap();
+        assert_that!(*configured_host_networks).is_empty();
    }

    fn given_score(hosts: Vec<PhysicalHost>) -> HostNetworkConfigurationScore {
@@ -591,48 +422,26 @@ mod tests {
        }
    }

-    #[derive(Debug)]
    struct TopologyWithSwitch {
        available_ports: Arc<Mutex<Vec<PortLocation>>>,
-        configured_port_channels: Arc<Mutex<Vec<(Id, HostNetworkConfig)>>>,
+        configured_host_networks: Arc<Mutex<Vec<(Id, HostNetworkConfig)>>>,
        switch_setup: Arc<Mutex<bool>>,
-        network_manager_setup: Arc<Mutex<bool>>,
-        configured_bonds: Arc<Mutex<Vec<(Id, HostNetworkConfig)>>>,
    }

    impl TopologyWithSwitch {
        fn new() -> Self {
            Self {
-                available_ports: Arc::new(Mutex::new(vec![
-                    PORT.clone(),
-                    ANOTHER_PORT.clone(),
-                    YET_ANOTHER_PORT.clone(),
-                    LAST_PORT.clone(),
-                ])),
-                configured_port_channels: Arc::new(Mutex::new(vec![])),
+                available_ports: Arc::new(Mutex::new(vec![PORT.clone(), ANOTHER_PORT.clone()])),
+                configured_host_networks: Arc::new(Mutex::new(vec![])),
                switch_setup: Arc::new(Mutex::new(false)),
-                network_manager_setup: Arc::new(Mutex::new(false)),
-                configured_bonds: Arc::new(Mutex::new(vec![])),
            }
        }

        fn new_port_not_found() -> Self {
            Self {
                available_ports: Arc::new(Mutex::new(vec![])),
-                configured_port_channels: Arc::new(Mutex::new(vec![])),
+                configured_host_networks: Arc::new(Mutex::new(vec![])),
                switch_setup: Arc::new(Mutex::new(false)),
-                network_manager_setup: Arc::new(Mutex::new(false)),
-                configured_bonds: Arc::new(Mutex::new(vec![])),
-            }
-        }
-
-        fn new_single_port_found() -> Self {
-            Self {
-                available_ports: Arc::new(Mutex::new(vec![PORT.clone()])),
-                configured_port_channels: Arc::new(Mutex::new(vec![])),
-                switch_setup: Arc::new(Mutex::new(false)),
-                network_manager_setup: Arc::new(Mutex::new(false)),
-                configured_bonds: Arc::new(Mutex::new(vec![])),
            }
        }
    }
@@ -648,22 +457,6 @@ mod tests {
        }
    }

-    #[async_trait]
-    impl NetworkManager for TopologyWithSwitch {
-        async fn ensure_network_manager_installed(&self) -> Result<(), NetworkError> {
-            let mut network_manager_installed = self.network_manager_setup.lock().unwrap();
-            *network_manager_installed = true;
-            Ok(())
-        }
-
-        async fn configure_bond(&self, config: &HostNetworkConfig) -> Result<(), NetworkError> {
-            let mut configured_bonds = self.configured_bonds.lock().unwrap();
-            configured_bonds.push((config.host_id.clone(), config.clone()));
-
-            Ok(())
-        }
-    }
-
    #[async_trait]
    impl Switch for TopologyWithSwitch {
        async fn setup_switch(&self) -> Result<(), SwitchError> {
@@ -683,12 +476,12 @@ mod tests {
            Ok(Some(ports.remove(0)))
        }

-        async fn configure_port_channel(
+        async fn configure_host_network(
            &self,
            config: &HostNetworkConfig,
        ) -> Result<(), SwitchError> {
-            let mut configured_port_channels = self.configured_port_channels.lock().unwrap();
-            configured_port_channels.push((config.host_id.clone(), config.clone()));
+            let mut configured_host_networks = self.configured_host_networks.lock().unwrap();
+            configured_host_networks.push((config.host_id.clone(), config.clone()));

            Ok(())
        }
--- a/harmony/src/modules/opnsense/mod.rs
+++ b/harmony/src/modules/opnsense/mod.rs
@@ -1,3 +1,4 @@
+pub mod node_exporter;
 mod shell;
 mod upgrade;
 pub use shell::*;
--- a/harmony/src/modules/opnsense/node_exporter.rs
+++ b/harmony/src/modules/opnsense/node_exporter.rs
@@ -0,0 +1,70 @@
+use async_trait::async_trait;
+use harmony_types::id::Id;
+use log::info;
+use serde::Serialize;
+
+use crate::{
+    data::Version,
+    interpret::{Interpret, InterpretError, InterpretName, InterpretStatus, Outcome},
+    inventory::Inventory,
+    score::Score,
+    topology::{Topology, node_exporter::NodeExporter},
+};
+
+#[derive(Debug, Clone, Serialize)]
+pub struct NodeExporterScore {}
+
+impl<T: Topology + NodeExporter> Score<T> for NodeExporterScore {
+    fn name(&self) -> String {
+        "NodeExporterScore".to_string()
+    }
+
+    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
+        Box::new(NodeExporterInterpret {})
+    }
+}
+
+#[derive(Debug)]
+pub struct NodeExporterInterpret {}
+
+#[async_trait]
+impl<T: Topology + NodeExporter> Interpret<T> for NodeExporterInterpret {
+    async fn execute(
+        &self,
+        _inventory: &Inventory,
+        node_exporter: &T,
+    ) -> Result<Outcome, InterpretError> {
+        info!(
+            "Making sure node exporter is initiailized: {:?}",
+            node_exporter.ensure_initialized().await?
+        );
+
+        info!("Applying Node Exporter configuration");
+
+        node_exporter.commit_config().await?;
+
+        info!("Reloading and restarting Node Exporter");
+
+        node_exporter.reload_restart().await?;
+
+        Ok(Outcome::success(format!(
+            "NodeExporter successfully configured"
+        )))
+    }
+
+    fn get_name(&self) -> InterpretName {
+        InterpretName::Custom("NodeExporter")
+    }
+
+    fn get_version(&self) -> Version {
+        todo!()
+    }
+
+    fn get_status(&self) -> InterpretStatus {
+        todo!()
+    }
+
+    fn get_children(&self) -> Vec<Id> {
+        todo!()
+    }
+}
--- a/harmony/src/modules/postgresql/capability.rs
+++ b/harmony/src/modules/postgresql/capability.rs
@@ -1,81 +0,0 @@
-use async_trait::async_trait;
-use harmony_types::storage::StorageSize;
-use std::collections::HashMap;
-
-#[async_trait]
-pub trait PostgreSQL {
-    async fn deploy(&self, config: &PostgreSQLConfig) -> Result<String, String>;
-
-    /// Extracts PostgreSQL-specific replication certs (PEM format) from a deployed primary cluster.
-    /// Abstracts away storage/retrieval details (e.g., secrets, files).
-    async fn get_replication_certs(&self, cluster_name: &str) -> Result<ReplicationCerts, String>;
-
-    /// Gets the internal/private endpoint (e.g., k8s service FQDN:5432) for the cluster.
-    async fn get_endpoint(&self, cluster_name: &str) -> Result<PostgreSQLEndpoint, String>;
-
-    /// Gets the public/externally routable endpoint if configured (e.g., OKD Route:443 for TLS passthrough).
-    /// Returns None if no public endpoint (internal-only cluster).
-    /// UNSTABLE: This is opinionated for initial multisite use cases. Networking abstraction is complex
-    /// (cf. k8s Ingress -> Gateway API evolution); may move to higher-order Networking/PostgreSQLNetworking trait.
-    async fn get_public_endpoint(&self, cluster_name: &str) -> Result<Option<PostgreSQLEndpoint>, String>;
-}
-
-#[derive(Clone, Debug)]
-pub struct PostgreSQLConfig {
-    pub cluster_name: String,
-    pub instances: u32,
-    pub storage_size: StorageSize,
-    pub role: PostgreSQLClusterRole,
-}
-
-#[derive(Clone, Debug)]
-pub enum PostgreSQLClusterRole {
-    Primary,
-    Replica(ReplicaClusterConfig),
-}
-
-#[derive(Clone, Debug)]
-pub struct ReplicaConfig {
-    /// Name of the primary cluster this replica will sync from
-    pub primary_cluster_name: String,
-    /// Certs extracted from primary via Topology::get_replication_certs()
-    pub replication_certs: ReplicationCerts,
-    /// Bootstrap method (e.g., pg_basebackup from primary)
-    pub bootstrap: BootstrapConfig,
-    /// External cluster connection details for CNPG spec.externalClusters
-    pub external_cluster: ExternalClusterConfig,
-}
-
-#[derive(Clone, Debug)]
-pub struct BootstrapConfig {
-    pub strategy: BootstrapStrategy,
-}
-
-#[derive(Clone, Debug)]
-pub enum BootstrapStrategy {
-    PgBasebackup,
-}
-
-#[derive(Clone, Debug)]
-pub struct ExternalClusterConfig {
-    /// Name used in CNPG externalClusters list
-    pub name: String,
-    /// Connection params (host/port set by multisite logic, sslmode='verify-ca', etc.)
-    pub connection_parameters: HashMap<String, String>,
-}
-
-#[derive(Clone, Debug)]
-pub struct ReplicationCerts {
-    /// PEM-encoded CA cert from primary
-    pub ca_cert_pem: String,
-    /// PEM-encoded streaming_replica client cert (tls.crt)
-    pub streaming_replica_cert_pem: String,
-    /// PEM-encoded streaming_replica client key (tls.key)
-    pub streaming_replica_key_pem: String,
-}
-
-#[derive(Clone, Debug)]
-pub struct PostgreSQLEndpoint {
-    pub host: String,
-    pub port: u16,
-}
--- a/harmony/src/modules/postgresql/mod.rs
+++ b/harmony/src/modules/postgresql/mod.rs
@@ -1,7 +0,0 @@
-
-pub mod capability;
-mod score;
-
-
-pub mod failover;
-
--- a/harmony/src/modules/postgresql/score.rs
+++ b/harmony/src/modules/postgresql/score.rs
@@ -1,236 +0,0 @@
-use crate::{
-    domain::{data::Version, interpret::InterpretStatus},
-    interpret::{Interpret, InterpretError, InterpretName, Outcome},
-    inventory::Inventory,
-    modules::postgresql::capability::PostgreSQL,
-    score::Score,
-    topology::Topology,
-};
-
-use super::capability::*;
-
-use derive_new::new;
-use harmony_types::{id::Id, storage::StorageSize};
-
-use async_trait::async_trait;
-use log::info;
-use serde::Serialize;
-
-pub struct PostgreSQLScore {
-    config: PostgreSQLConfig,
-}
-
-#[derive(Debug, Clone)]
-pub struct PostgreSQLInterpret {
-    config: PostgreSQLConfig,
-    version: Version,
-    status: InterpretStatus,
-}
-
-impl PostgreSQLInterpret {
-    pub fn new(config: PostgreSQLConfig) -> Self {
-        let version = Version::from("1.0.0").expect("Version should be valid");
-        Self {
-            config,
-            version,
-            status: InterpretStatus::QUEUED,
-        }
-    }
-}
-
-impl<T: Topology + PostgreSQL> Score<T> for PostgreSQLScore {
-    fn name(&self) -> String {
-        "PostgreSQLScore".to_string()
-    }
-
-    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        Box::new(PostgreSQLInterpret::new(self.config.clone()))
-    }
-}
-
-#[async_trait]
-impl<T: Topology + PostgreSQL> Interpret<T> for PostgreSQLInterpret {
-    fn get_name(&self) -> InterpretName {
-        InterpretName::Custom("PostgreSQLInterpret")
-    }
-
-    fn get_version(&self) -> crate::domain::data::Version {
-        self.version.clone()
-    }
-
-    fn get_status(&self) -> InterpretStatus {
-        self.status.clone()
-    }
-
-    fn get_children(&self) -> Vec<Id> {
-        todo!()
-    }
-
-    async fn execute(
-        &self,
-        _inventory: &Inventory,
-        topology: &T,
-    ) -> Result<Outcome, InterpretError> {
-        info!(
-            "Executing PostgreSQLInterpret with config {:?}",
-            self.config
-        );
-
-        let cluster_name = topology
-            .deploy(&self.config)
-            .await
-            .map_err(|e| InterpretError::from(e))?;
-
-        Ok(Outcome::success(format!(
-            "Deployed PostgreSQL cluster `{cluster_name}`"
-        )))
-    }
-}
-
-#[derive(Debug, new, Clone, Serialize)]
-pub struct MultisitePostgreSQLScore {
-    pub cluster_name: String,
-    pub primary_site: Id,
-    pub replica_sites: Vec<Id>,
-    pub instances: u32,
-    pub storage_size: StorageSize,
-}
-
-impl<T: FailoverTopology + crate::modules::postgresql::capability::PostgreSQL> Score<T> for MultisitePostgreSQLScore {
-
-    fn create_interpret(&self) -> Box<dyn Interpret<T>> {
-        Box::new(MultisitePostgreSQLInterpret::new(self.clone()))
-    }
-
-    fn name(&self) -> String {
-        "MultisitePostgreSQLScore".to_string()
-    }
-}
-
-#[derive(Debug, Clone)]
-pub struct MultisitePostgreSQLInterpret {
-    score: MultisitePostgreSQLScore,
-    version: Version,
-    status: InterpretStatus,
-}
-
-impl MultisitePostgreSQLInterpret {
-    pub fn new(score: MultisitePostgreSQLScore) -> Self {
-        let version = Version::from("1.0.0").expect("Version should be valid");
-        Self {
-            score,
-            version,
-            status: InterpretStatus::QUEUED,
-        }
-    }
-}
-
-#[async_trait]
-impl<T: MultisiteTopology + PostgreSQL> Interpret<T> for MultisitePostgreSQLInterpret {
-    fn get_name(&self) -> InterpretName {
-        InterpretName::Custom("MultisitePostgreSQLInterpret")
-    }
-
-    fn get_version(&self) -> Version {
-        self.version.clone()
-    }
-
-    fn get_status(&self) -> InterpretStatus {
-        self.status.clone()
-    }
-
-    fn get_children(&self) -> Vec<Id> {
-        todo!("Track child interprets per site")
-    }
-
-async fn execute(
-    &self,
-    inventory: &Inventory,
-    topology: &T,
-) -> Result<Outcome, InterpretError> {
-
-        info!(
-            "Orchestrating multisite PostgreSQL: primary {:?}, replicas {:?}",
-            self.score.primary_site, self.score.replica_sites
-        );
-
-        // 1. Deploy primary
-        let primary_topo = topology.primary();
-
-        let primary_config = PostgreSQLConfig {
-            cluster_name: self.score.cluster_name.clone(),
-            instances: self.score.instances,
-            storage_size: self.score.storage_size.clone(),
-            role: ClusterRole::Primary,
-        };
-        let primary_cluster_name = primary_topo
-            .deploy(&primary_config)
-            .await
-            .map_err(|e| InterpretError::from(format!("Primary deploy failed: {e}")))?;
-
-        // 2. Extract certs & public endpoint from primary
-        let certs = primary_topo
-            .get_replication_certs(&primary_cluster_name)
-            .await
-            .map_err(|e| InterpretError::from(format!("Certs extract failed: {e}")))?;
-        let public_endpoint = primary_topo
-            .get_public_endpoint(&primary_cluster_name)
-            .await??
-            .ok_or_else(|| InterpretError::from("No public endpoint on primary"))?;
-
-        // 3. Deploy replicas
-        for replica_site in &self.score.replica_sites {
-let replica_topo = topology.replica();
-
-                .map_err(|e| {
-                    InterpretError::from(format!(
-                        "Replica site {:?} lookup failed: {e}",
-                        replica_site
-                    ))
-                })?;
-
-            let connection_params: HashMap<String, String> = [
-                ("host".to_string(), public_endpoint.host.clone()),
-                ("port".to_string(), public_endpoint.port.to_string()),
-                ("dbname".to_string(), "postgres".to_string()),
-                ("user".to_string(), "streaming_replica".to_string()),
-                ("sslmode".to_string(), "verify-ca".to_string()),
-                ("sslnegotiation".to_string(), "direct".to_string()),
-            ]
-            .into_iter()
-            .collect();
-
-            let external_cluster = ExternalClusterConfig {
-                name: "primary-cluster".to_string(),
-                connection_parameters: connection_params,
-            };
-
-            let replica_config_struct = ReplicaConfig {
-                primary_cluster_name: primary_cluster_name.clone(),
-                replication_certs: certs.clone(),
-                bootstrap: BootstrapConfig {
-                    strategy: BootstrapStrategy::PgBasebackup,
-                },
-                external_cluster,
-            };
-
-            let replica_config = PostgreSQLConfig {
-                cluster_name: format!("{}-replica-{}", self.score.cluster_name, replica_site),
-                instances: self.score.instances,
-                storage_size: self.score.storage_size.clone(),
-                role: ClusterRole::Replica(replica_config_struct),
-            };
-
-            let _replica_cluster = replica_topo.deploy(&replica_config).await.map_err(|e| {
-                InterpretError::from(format!("Replica {:?} deploy failed: {e}", replica_site))
-            })?;
-        }
-
-        Ok(Outcome::success(format!(
-            "Multisite PostgreSQL `{}` deployed: primary `{}`, {} replicas",
-            self.score.cluster_name,
-            primary_cluster_name,
-            self.score.replica_sites.len()
-        )))
-    }
-}
--- a/harmony_types/src/lib.rs
+++ b/harmony_types/src/lib.rs
@@ -1,4 +1,3 @@
 pub mod id;
 pub mod net;
 pub mod switch;
-pub mod storage;
--- a/harmony_types/src/net.rs
+++ b/harmony_types/src/net.rs
@@ -1,6 +1,6 @@
 use serde::{Deserialize, Serialize};

-#[derive(Copy, Clone, PartialEq, Eq, Hash, Serialize, Deserialize, PartialOrd, Ord)]
+#[derive(Copy, Clone, Debug, PartialEq, Eq, Hash, Serialize, Deserialize, PartialOrd, Ord)]
 pub struct MacAddress(pub [u8; 6]);

 impl MacAddress {
@@ -19,14 +19,6 @@ impl From<&MacAddress> for String {
    }
 }

-impl std::fmt::Debug for MacAddress {
-    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
-        f.debug_tuple("MacAddress")
-            .field(&String::from(self))
-            .finish()
-    }
-}
-
 impl std::fmt::Display for MacAddress {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.write_str(&String::from(self))
--- a/harmony_types/src/storage.rs
+++ b/harmony_types/src/storage.rs
@@ -1,6 +0,0 @@
-use serde::{Deserialize, Serialize};
-
-#[derive(Copy, Clone, PartialEq, Eq, Hash, Serialize, Deserialize, PartialOrd, Ord, Debug)]
-pub struct StorageSize {
-    size_bytes: u64,
-}
--- a/opnsense-config-xml/src/data/interfaces.rs
+++ b/opnsense-config-xml/src/data/interfaces.rs
@@ -9,7 +9,7 @@ pub struct Interface {
    pub physical_interface_name: String,
    pub descr: Option<MaybeString>,
    pub mtu: Option<MaybeString>,
-    pub enable: Option<MaybeString>,
+    pub enable: MaybeString,
    pub lock: Option<MaybeString>,
    #[yaserde(rename = "spoofmac")]
    pub spoof_mac: Option<MaybeString>,
@@ -134,15 +134,19 @@ mod test {
  <interfaces>
    <paul>
      <if></if>
+      <enable/>
    </paul>
    <anotherpaul>
      <if></if>
+      <enable/>
    </anotherpaul>
    <thirdone>
      <if></if>
+      <enable/>
    </thirdone>
    <andgofor4>
      <if></if>
+      <enable/>
    </andgofor4>
  </interfaces>
  <bar>foo</bar>
--- a/opnsense-config-xml/src/data/opnsense.rs
+++ b/opnsense-config-xml/src/data/opnsense.rs
@@ -17,7 +17,7 @@ pub struct OPNsense {
    pub interfaces: NamedList<Interface>,
    pub dhcpd: NamedList<DhcpInterface>,
    pub snmpd: Snmpd,
-    pub syslog: Syslog,
+    pub syslog: Option<Syslog>,
    pub nat: Nat,
    pub filter: Filters,
    pub load_balancer: Option<LoadBalancer>,
@@ -190,7 +190,7 @@ pub struct System {
    pub webgui: WebGui,
    pub usevirtualterminal: u8,
    pub disablenatreflection: Option<String>,
-    pub disableconsolemenu: u8,
+    pub disableconsolemenu: Option<u8>,
    pub disablevlanhwfilter: u8,
    pub disablechecksumoffloading: u8,
    pub disablesegmentationoffloading: u8,
@@ -216,7 +216,7 @@ pub struct System {
    pub maximumfrags: Option<MaybeString>,
    pub aliasesresolveinterval: Option<MaybeString>,
    pub maximumtableentries: Option<MaybeString>,
-    pub language: String,
+    pub language: Option<String>,
    pub dnsserver: Option<MaybeString>,
    pub dns1gw: Option<String>,
    pub dns2gw: Option<String>,
@@ -233,16 +233,16 @@ pub struct System {
 #[derive(Default, PartialEq, Debug, YaSerialize, YaDeserialize)]
 pub struct Ssh {
    pub group: String,
-    pub noauto: u8,
-    pub interfaces: MaybeString,
-    pub kex: MaybeString,
-    pub ciphers: MaybeString,
-    pub macs: MaybeString,
-    pub keys: MaybeString,
-    pub enabled: String,
-    pub passwordauth: u8,
-    pub keysig: MaybeString,
-    pub permitrootlogin: u8,
+    pub noauto: Option<u8>,
+    pub interfaces: Option<MaybeString>,
+    pub kex: Option<MaybeString>,
+    pub ciphers: Option<MaybeString>,
+    pub macs: Option<MaybeString>,
+    pub keys: Option<MaybeString>,
+    pub enabled: Option<String>,
+    pub passwordauth: Option<u8>,
+    pub keysig: Option<MaybeString>,
+    pub permitrootlogin: Option<u8>,
    pub rekeylimit: Option<MaybeString>,
 }

@@ -306,11 +306,11 @@ pub struct WebGui {
    pub protocol: String,
    #[yaserde(rename = "ssl-certref")]
    pub ssl_certref: String,
-    pub port: MaybeString,
+    pub port: Option<MaybeString>,
    #[yaserde(rename = "ssl-ciphers")]
-    pub ssl_ciphers: MaybeString,
-    pub interfaces: MaybeString,
-    pub compression: MaybeString,
+    pub ssl_ciphers: Option<MaybeString>,
+    pub interfaces: Option<MaybeString>,
+    pub compression: Option<MaybeString>,
    pub nohttpreferercheck: Option<u8>,
 }

@@ -433,7 +433,7 @@ pub struct OPNsenseXmlSection {
    #[yaserde(rename = "Interfaces")]
    pub interfaces: Option<ConfigInterfaces>,
    #[yaserde(rename = "NodeExporter")]
-    pub node_exporter: Option<RawXml>,
+    pub node_exporter: Option<NodeExporter>,
    #[yaserde(rename = "Kea")]
    pub kea: Option<RawXml>,
    pub monit: Option<Monit>,
@@ -1595,3 +1595,21 @@ pub struct Ifgroups {
    #[yaserde(attribute = true)]
    pub version: String,
 }
+
+#[derive(Default, PartialEq, Debug, YaSerialize, YaDeserialize)]
+pub struct NodeExporter {
+    pub enabled: u8,
+    pub listenaddress: Option<MaybeString>,
+    pub listenport: u16,
+    pub cpu: u8,
+    pub exec: u8,
+    pub filesystem: u8,
+    pub loadavg: u8,
+    pub meminfo: u8,
+    pub netdev: u8,
+    pub time: u8,
+    pub devstat: u8,
+    pub interrupts: u8,
+    pub ntp: u8,
+    pub zfs: u8,
+}
--- a/opnsense-config/src/config/config.rs
+++ b/opnsense-config/src/config/config.rs
@@ -5,7 +5,8 @@ use crate::{
    error::Error,
    modules::{
        caddy::CaddyConfig, dhcp_legacy::DhcpConfigLegacyISC, dns::UnboundDnsConfig,
-        dnsmasq::DhcpConfigDnsMasq, load_balancer::LoadBalancerConfig, tftp::TftpConfig,
+        dnsmasq::DhcpConfigDnsMasq, load_balancer::LoadBalancerConfig,
+        node_exporter::NodeExporterConfig, tftp::TftpConfig,
    },
 };
 use log::{debug, info, trace, warn};
@@ -13,6 +14,7 @@ use opnsense_config_xml::OPNsense;
 use russh::client;
 use serde::Serialize;
 use sha2::Digest;
+use tokio::time::{sleep, Duration};

 use super::{ConfigManager, OPNsenseShell};

@@ -71,6 +73,10 @@ impl Config {
        LoadBalancerConfig::new(&mut self.opnsense, self.shell.clone())
    }

+    pub fn node_exporter(&mut self) -> NodeExporterConfig<'_> {
+        NodeExporterConfig::new(&mut self.opnsense, self.shell.clone())
+    }
+
    pub async fn upload_files(&self, source: &str, destination: &str) -> Result<String, Error> {
        self.shell.upload_folder(source, destination).await
    }
@@ -150,7 +156,8 @@ impl Config {

    async fn reload_config(&mut self) -> Result<(), Error> {
        info!("Reloading opnsense live config");
-        let (opnsense, sha2) = Self::get_opnsense_instance(self.repository.clone()).await?;
+        let (opnsense, _sha2) = Self::get_opnsense_instance(self.repository.clone()).await?;
+        self.opnsense = opnsense;
        Ok(())
    }

--- a/opnsense-config/src/modules/mod.rs
+++ b/opnsense-config/src/modules/mod.rs
@@ -4,4 +4,5 @@ pub mod dhcp_legacy;
 pub mod dns;
 pub mod dnsmasq;
 pub mod load_balancer;
+pub mod node_exporter;
 pub mod tftp;
--- a/opnsense-config/src/modules/node_exporter.rs
+++ b/opnsense-config/src/modules/node_exporter.rs
@@ -0,0 +1,54 @@
+use std::sync::Arc;
+
+use opnsense_config_xml::{NodeExporter, OPNsense};
+
+use crate::{config::OPNsenseShell, Error};
+
+pub struct NodeExporterConfig<'a> {
+    opnsense: &'a mut OPNsense,
+    opnsense_shell: Arc<dyn OPNsenseShell>,
+}
+
+impl<'a> NodeExporterConfig<'a> {
+    pub fn new(opnsense: &'a mut OPNsense, opnsense_shell: Arc<dyn OPNsenseShell>) -> Self {
+        Self {
+            opnsense,
+            opnsense_shell,
+        }
+    }
+
+    pub fn get_full_config(&self) -> &Option<NodeExporter> {
+        &self.opnsense.opnsense.node_exporter
+    }
+
+    fn with_node_exporter<F, R>(&mut self, f: F) -> Result<R, &'static str>
+    where
+        F: FnOnce(&mut NodeExporter) -> R,
+    {
+        match &mut self.opnsense.opnsense.node_exporter.as_mut() {
+            Some(node_exporter) => Ok(f(node_exporter)),
+            None => Err("node exporter is not yet installed"),
+        }
+    }
+
+    pub fn enable(&mut self, enabled: bool) -> Result<(), &'static str> {
+        self.with_node_exporter(|node_exporter| node_exporter.enabled = enabled as u8)
+            .map(|_| ())
+    }
+
+    pub async fn reload_restart(&self) -> Result<(), Error> {
+        self.opnsense_shell
+            .exec("configctl node_exporter stop")
+            .await?;
+        self.opnsense_shell
+            .exec("configctl template reload OPNsense/NodeExporter")
+            .await?;
+        self.opnsense_shell
+            .exec("configctl node_exporter configtest")
+            .await?;
+        self.opnsense_shell
+            .exec("configctl node_exporter start")
+            .await?;
+        Ok(())
+    }
+}
Author	SHA1	Message	Date
Willem	c2fa4f1869	fix:cargo fmt All checks were successful Run Check Script / check (pull_request) Successful in 1m21s Details	2025-10-29 13:53:58 -04:00
Willem	ee278ac817	Merge remote-tracking branch 'origin/master' into feat/install_opnsense_node_exporter Some checks failed Run Check Script / check (pull_request) Failing after 25s Details	2025-10-29 13:49:56 -04:00
Willem	09a06f136e	Merge remote-tracking branch 'origin/master' into feat/install_opnsense_node_exporter All checks were successful Run Check Script / check (pull_request) Successful in 1m21s Details	2025-10-29 13:42:12 -04:00
Willem	5f147fa672	fix: opnsense-config reload_config() returns live config.xml rather than dropping it, allows function is_package_installed() to read live state after package installation rather than old config before installation All checks were successful Run Check Script / check (pull_request) Successful in 1m17s Details	2025-10-29 13:25:37 -04:00
Willem	9ba939bde1	wip: cargo fmt All checks were successful Run Check Script / check (pull_request) Successful in 1m16s Details	2025-10-28 15:45:02 -04:00
Willem	44bf21718c	wip: example score with impl topolgy for opnsense topology	2025-10-28 14:41:15 -04:00
Willem	5ab58f0253	fix: added impl node exporter for hacluster topology and dummy infra All checks were successful Run Check Script / check (pull_request) Successful in 1m26s Details	2025-10-22 14:39:12 -04:00
Willem	5af13800b7	fix: removed unimplemnted marco and returned Err instead Some checks failed Run Check Script / check (pull_request) Failing after 29s Details some formatting error	2025-10-22 11:51:22 -04:00
Willem	8126b233d8	feat: implementation for opnsense os-node_exporter Some checks failed Run Check Script / check (pull_request) Failing after 41s Details	2025-10-22 11:27:28 -04:00