thermograph/infra/deploy/swarm/init-swarm.sh

#!/usr/bin/env bash
# Run ONCE, on the manager node only (vps2 — the box with headroom for prod's
# and beta's Swarm stacks and their local volumes). Initializes the Swarm
# advertising the WireGuard address, so cluster traffic never touches the
# public interface. Run setup-wireguard.sh on all THREE nodes first (vps2,
# vps1, and the desktop — see
# docs/runbooks/implementation-handoff.md Track B steps 2-3).
set -euo pipefail

MY_WG_IP="${1:?usage: $0 <my_wg_ip>}"

if docker info 2>/dev/null | grep -q "Swarm: active"; then
  echo "Swarm is already active on this node. Current state:"
  docker node ls
  echo
  echo "Worker join token:"
  docker swarm join-token -q worker
  exit 0
fi

echo "==> docker swarm init, advertising ${MY_WG_IP} (the WireGuard address, not the public IP)"
docker swarm init --advertise-addr "$MY_WG_IP" --listen-addr "${MY_WG_IP}:2377"

echo
echo "==> Worker join command (run this on EACH of the two workers — vps1 and"
echo "    the desktop; the same token works for both):"
TOKEN="$(docker swarm join-token -q worker)"
echo "    docker swarm join --token ${TOKEN} ${MY_WG_IP}:2377"
echo
echo "(Or run deploy/swarm/join-swarm.sh <manager_wg_ip> <token> on each worker.)"