admin
64b7436015
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017PsnU2ASocYrvzqE82YDYW
101 lines
7.0 KiB
Markdown
101 lines
7.0 KiB
Markdown
# REPORT — v0.40.0: SSD user-data volume (`/mnt/sys_drive`, mp1) — the third CT-volume split
|
|
|
|
**Task:** add a third CT volume (`mp1` @ `/mnt/sys_drive`, `backup=1`) baked into the golden + grown
|
|
at provision (`-sysdata-grow`), so the controller's `system_data_path` becomes a separate, PBS-covered
|
|
mount and the "not a separate drive" warning clears with **zero controller change**. Option A (static
|
|
CT volume, NOT the enrolled-drive intent machinery).
|
|
|
|
## 1. Baselines
|
|
- felhom-agent `main` @ `b908b9a` (= spec's `b908b9a8e`), version **v0.39.0** → **v0.40.0**.
|
|
- Currently-deployed in-guest controller: **`felhom-controller:0.77.0`** (spec guessed 0.76.0; actual
|
|
is 0.77.0 — this is the `CONTROLLER_IMAGE` the golden must bake).
|
|
- felhom-controller **untouched** (it already expects `/mnt/sys_drive` + warns via
|
|
`system.IsMountPoint`).
|
|
|
|
## 2. Files modified (felhom-agent only)
|
|
- `configs/build-golden.sh` — `--mp1 ...,mp=/mnt/sys_drive,backup=1` (env `GOLDEN_SYSDATA_GB=8`);
|
|
`findmnt /mnt/sys_drive` separate-mount guard; vzdump-inclusion guard now aborts if **mp0 OR mp1**
|
|
excluded (the B3 trap), with the mirrored WARN-if-unconfirmed.
|
|
- `internal/reconcile/bringup.go` — `const DefaultSysDataMount = "mp1"`; `BringUpSpec.{SysDataGrowGB,
|
|
SysDataMount}`; new **"4c"** online grow-only `ResizeLXC` block mirroring the "4b" Docker-data grow.
|
|
- `cmd/felhom-agent/main.go` — `-sysdata-grow` / `-sysdata-mount` flags; `bringUpSizing.{SysDataGrowGB,
|
|
SysDataMount}`; wired at all three sites (the two `--selftest=bring-up` dispatch/spec paths + the
|
|
`--selftest=provision` spec); version `0.40.0`; `--selftest=provision` help text updated.
|
|
- `internal/reconcile/bringup_test.go` — `TestRunBringUp_StorageSplit_SysDataGrow` +
|
|
`…_SysDataGrowZeroNoResize`.
|
|
- `CHANGELOG.md` (v0.40.0 entry, newest on top), `RUNBOOK-provisioning-storage.md` (three-volume
|
|
layout), this `REPORT.md`.
|
|
|
|
## 3. Commits pushed to `main`
|
|
- `459dad9` — v0.40.0: third CT volume + `-sysdata-grow` (code + tests + CHANGELOG + RUNBOOK).
|
|
- (REPORT.md commit follows.)
|
|
|
|
## 4. Tests + red-proofs
|
|
- `go build ./... && go vet ./... && go test ./...` — **green** (reconcile + cmd + all packages).
|
|
- Pre-existing unrelated flake: `internal/escrow/TestGenerateRecoveryCode_EntropyAndFormat`
|
|
(random 10/11-word count) — passes on re-run; **not touched by this change**.
|
|
- `TestRunBringUp_StorageSplit_SysDataGrow`: PASS — fake api records `ResizeLXC(8051,"mp1","+42G")`
|
|
alongside `mp0 +240G`.
|
|
- `TestRunBringUp_StorageSplit_SysDataGrowZeroNoResize`: PASS — `SysDataGrowGB=0` ⇒ **no** mp1 resize.
|
|
- **Red-proof #1 (Go "4c" block):** removed the "4c" grow block → `…_SysDataGrow` FAILED
|
|
(`got [{mp0 +240G}]`, no mp1 resize) → reverted → green. ✅
|
|
- reconcile test count: 127 RUN entries (subtests included), all pass.
|
|
- **Red-proof #2 (shell vzdump guard):** to be run live during the golden rebuild — temporarily flip
|
|
`mp1` to `backup=0`, confirm the guard ABORTS, revert. **PENDING (needs golden rebuild — §6).**
|
|
|
|
## 5. Live deploy DONE — agent binary (§13-A)
|
|
- Built v0.40.0 on the build server (192.168.0.180, go1.26.0, `-ldflags -X main.version=0.40.0`).
|
|
- Deployed to felhom-pve: backed up prior binary to `/usr/local/bin/felhom-agent.bak-0.39.0`,
|
|
installed, `systemctl restart felhom-agent`.
|
|
- **Verified:** `felhom-agent --version` → `0.40.0`; service `active`; clean restart (local-api
|
|
listening on 192.168.0.162:8443; only WARN is the expected intent-gated skip of the lingering ejected
|
|
`ce9d…` drive on 9201 — documented prior behavior, not an error).
|
|
|
|
## 6. Live acceptance — PENDING (blocked on operator-held secrets + an irreversible CHECKPOINT)
|
|
The golden rebuild (§13-B), the `pct destroy 9201` CHECKPOINT (§13-C), and the re-provision (§13-D/E)
|
|
were **not** executed because they require inputs CC does not hold:
|
|
1. **`REGISTRY_USER` + `REGISTRY_TOKEN`** — for the golden's one-time controller-image pull inside the
|
|
build guest. Confirmed **absent on-host** (no `/root/.docker/config.json`, no saved build env).
|
|
2. **`DEMO_RETRIEVAL_PASSPHRASE`** (the `-hub-password`) — for the 9201 re-provision (the controller's
|
|
hub config pull).
|
|
3. **Operator confirmation** for the irreversible `pct stop 9201; pct destroy 9201 --purge` (§13-C
|
|
CHECKPOINT). Operator pre-authorized a clean reinstall in principle, but the destroy is gated.
|
|
|
|
Planned live run once provided (locked sizing per RUNBOOK = 32 rootfs / 200 docker-data / 50 user-data):
|
|
```
|
|
# B. rebuild golden (root@felhom-pve) — bake controller 0.77.0
|
|
GOLDEN_SYSDATA_GB=8 REGISTRY_USER=… REGISTRY_TOKEN=… \
|
|
./build-golden.sh 9100 <TEMPLATE> local-lvm local vmbr0 \
|
|
gitea.dooplex.hu/admin/felhom-controller:0.77.0
|
|
# → vzdump log MUST show BOTH "including mount point mp0" AND "… mp1"; capture the new volid.
|
|
# → Red-proof #2 here (flip mp1 backup=0 → guard aborts → revert).
|
|
# C. CHECKPOINT: pct stop 9201; pct destroy 9201 --purge
|
|
# D. re-provision: felhom-agent --selftest=provision -archive <new-golden> -vmid 9201 \
|
|
# -customer-id demo-felhom -hub-password <SECRET> -rootfs-grow 0 -datavol-grow 184 -sysdata-grow 42
|
|
# then: pct reboot 9201
|
|
# E. accept: pct config 9201 (mp0,mp1 backup=1,mp8,mp9) ; pct exec 9201 -- findmnt /mnt/sys_drive ;
|
|
# pct exec 9201 -- docker exec felhom-controller findmnt /mnt/sys_drive (← propagation gate) ;
|
|
# controller monitor: /mnt/sys_drive warning GONE, SSD user-data ~50G.
|
|
```
|
|
Current 9201 baseline (pre-change, confirms the warning state): rootfs 32G, `mp0` docker-data 256G
|
|
(backup=1), `mp3` `/mnt/felhom-drives`, `mp9` bootstrap — **no `mp1` / `/mnt/sys_drive` volume** (so
|
|
`/mnt/sys_drive` is on the rootfs and the controller warns). Memory 12288 MiB.
|
|
|
|
## 7. NOT yet live-validated / residual
|
|
- The §13-B golden rebuild, the §13-D/E re-provision + acceptance gates (the three `findmnt`s + the
|
|
controller-UI/API warning-cleared check), and shell-guard Red-proof #2 — **all blocked on §6**.
|
|
- **External-drive re-enroll** after the clean reinstall: the destroy wipes the controller's
|
|
`felhom-controller-data` volume (its storage registry), so `felhom-usb`/`felhom-flash` will need
|
|
re-enrollment via the UI. Expected for a clean reinstall; **out of scope** for this task's acceptance
|
|
(solely `/mnt/sys_drive` becoming a separate, warning-free, PBS-covered mount).
|
|
|
|
## 8. Observations (noted, NOT acted on)
|
|
- `build-golden.sh` `CONTROLLER_IMAGE` default is stale (`:0.43.0`); the live controller is `0.77.0`.
|
|
The golden rebuild passes the tag explicitly, so the stale default is cosmetic — left as-is per the
|
|
minimal-change rule.
|
|
- `felhom-agent/CLAUDE.md` self-reports "Current: v0.31.0" — stale; authoritative version is the
|
|
`main.go` var + CHANGELOG top (now `0.40.0`). Left as-is (out of scope).
|
|
- Live 9201 uses `mp3` for the shared drives parent (`/mnt/felhom-drives`), not the `mp8` the spec
|
|
cited — `freeMountSlot` picks the lowest free slot, so the exact number varies. The baked `mp1` does
|
|
not collide regardless (the guest is rebuilt from the new golden). No action needed.
|