docs: D.1b narrowed + drill B2/B3 marked FIXED (agent v0.63.0)
Restart-the-agent step in day0-install.md is now conditional on agent < v0.63.0 (reload-on-miss shipped; Day-0 manifest still vouches 0.62.0). Troubleshooting row + drill ledger + go/no-go item 8 updated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
@@ -3,6 +3,10 @@
|
||||
> Created with the REUSE.md rollout (2026-07-03). Authoritative history: `hub/CHANGELOG.md` (hub),
|
||||
> `website/CHANGELOG.md`, `scripts/CHANGELOG.md`; end-of-task detail in `REPORT.md`.
|
||||
|
||||
- **2026-07-03 — drill findings B2+B3 FIXED (agent v0.63.0, live on felhom-pve + published)** —
|
||||
token reload-on-miss (no more fresh-install 401/manual restart) + guesthook snippets-dir mkdir.
|
||||
Guide D.1b restart step narrowed to "agent < v0.63.0"; drill ledger updated. **OPERATOR: vouch
|
||||
agent 0.63.0 in the Day-0 manifest UI** (until then fresh installs fetch 0.62.0).
|
||||
- **2026-07-03 — GO-LIVE PACKAGE SHIPPED (host-install v1.9.1 + day0-install runbook + clean-room drill)** —
|
||||
`documentation/runbooks/day0-install.md` is the operator Day-0 guide, **every command executed
|
||||
verbatim** on a throwaway nested PVE 9.2.2 (build server): install → verify → app deploy →
|
||||
|
||||
@@ -165,7 +165,7 @@ cores/RAM for the cap, root SSH, outbound reach incl. the three exact URLs+expec
|
||||
| 5 | Real CF tunnel token created + entered in Part A (drill used a fake) | ⚠️ operator does A.1 for sajatfelhom.hu; tunnel leg is demo-proven, not drill-proven |
|
||||
| 6 | `git.username`/`git.token` set in the customer config | ⚠️ REQUIRED (installer dies without it) |
|
||||
| 7 | Multi-node? If Peti's box is a cluster, add `--node` | per Part B answer |
|
||||
| 8 | Known non-blockers on the box: B2 (no pre-start hook on fresh boxes), B3 (401-until-agent-restart) | documented + workarounds in the guide |
|
||||
| 8 | Known non-blockers on the box: B2 (no pre-start hook on fresh boxes), B3 (401-until-agent-restart) | **both FIXED in agent v0.63.0** (2026-07-03, Gitea-published); effective for fresh installs once the Day-0 manifest vouches ≥ 0.63.0 — until then the D.1b restart step covers B3 |
|
||||
|
||||
**Verdict: GO** — with items 3/5/6 executed on/before install day.
|
||||
|
||||
@@ -176,8 +176,8 @@ cores/RAM for the cap, root SSH, outbound reach incl. the three exact URLs+expec
|
||||
| R1–R5 | installer | — | uninstall residue (config w/ secrets, shared-parent unit+script+mount, mkfs wrapper, hook snippet, dnsmasq snippets) | **FIXED v1.9.1**, residue-diff-proven |
|
||||
| R6 | installer | — | controller-bootstrap unit skipped: no post-provision reboot (agent hot-plugs the mount; unit condition is boot-time) | **FIXED v1.9.1** (reboot + bounded verify wait), D6b-proven |
|
||||
| B1 | agent/golden | LOW | structural fix for R6 belongs in the product too (path unit in the golden, or agent-side restart after back-half) — installer reboot is a correct but external crutch | RECORDED (agent/golden follow-up) |
|
||||
| B2 | agent | LOW | `guesthook.InstallSnippet` fails on a fresh box: `/var/lib/vz/snippets` doesn't exist and `install` won't create it → no pre-start self-heal hook, warn-only (`install: cannot create regular file … No such file or directory`, agent journal 14:58:40) | RECORDED (fix: mkdir -p SnippetDir; demo box unaffected — dir pre-exists) |
|
||||
| B3 | agent | MED | fresh-install local-API **401 until `systemctl restart felhom-agent`** (stale token map, pre-existing open issue) — NEW consequence found: it blocks the controller self-update agent-swap | RECORDED (workaround = guide D.1b step 1) |
|
||||
| B2 | agent | LOW | `guesthook.InstallSnippet` fails on a fresh box: `/var/lib/vz/snippets` doesn't exist and `install` won't create it → no pre-start self-heal hook, warn-only (`install: cannot create regular file … No such file or directory`, agent journal 14:58:40) | **FIXED agent v0.63.0** (fenced `mkdir -p` precedes the install + the one sudoers grant; red-proofed — felhom-agent REPORT 2026-07-03) |
|
||||
| B3 | agent | MED | fresh-install local-API **401 until `systemctl restart felhom-agent`** — root cause: the daemon's TokenStore index is built once at open, while provisioning is a SEPARATE one-shot process minting into the shared file; NEW consequence found: it blocks the controller self-update agent-swap | **FIXED agent v0.63.0** (`Lookup` reload-on-miss, red-proofed + run on felhom-pve — felhom-agent REPORT 2026-07-03). Guide D.1b restart-step narrowed to "agent < v0.63.0" — applies until the Day-0 manifest vouches ≥ 0.63.0 |
|
||||
| B4 | hub | LOW | **no host-delete path** (UI or API) — drill host rows removed via direct SQL (spike precedent); customer-delete exists but leaves hosts/reports/guests/events orphaned | RECORDED (candidate small hub follow-up) |
|
||||
| B5 | golden/fleet | MED | golden bakes a pre-floor controller (0.85.1) → every fresh install needs D.1b manually | RECORDED (operator follow-up: rebuild golden ≥ 0.86.0 + re-vouch in the Day-0 manifest UI) |
|
||||
|
||||
|
||||
@@ -231,8 +231,9 @@ install does NOT auto-update, regardless of the hub floor**. Bring it current on
|
||||
floor mechanism manages it:
|
||||
|
||||
```bash
|
||||
# 1. Restart the agent first — a fresh install's local API 401s the swap until the agent restarts
|
||||
# (known open issue; see troubleshooting)
|
||||
# 1. ONLY if the installed agent is OLDER than v0.63.0 (check: felhom-agent --version): restart it
|
||||
# first — pre-v0.63.0 agents 401 the update's swap call until restarted (fixed in v0.63.0 by
|
||||
# token reload-on-miss; which agent you got depends on what the hub Day-0 manifest vouched)
|
||||
systemctl restart felhom-agent
|
||||
|
||||
# 2. In the dashboard: Beállítások → "Frissítés" (update to latest), or equivalently:
|
||||
@@ -311,7 +312,7 @@ roles/ACL/token/user, the pool (if empty), the install state file.
|
||||
| step 1: passphrase REJECTED (401) | typo / wrong customer | re-check with the hub UI's printed curl command |
|
||||
| step 8 fails: "CT <vmid> already exists" | vmid collision with a hub-invisible guest | pick from `pct list` + `qm list` (Part B); the agent destroys nothing on collision — re-run with a free vmid and `--resume` |
|
||||
| controller container missing in-guest after provision (docker ps empty) | pre-v1.9.1 script: the controller-bootstrap unit's boot-time condition lost the race with the bootstrap-mount attach | `pct reboot <VMID>` — the unit runs on the next boot (v1.9.1 does this reboot itself) |
|
||||
| self-update fails: "Agent swap request failed: HTTP 401" (or dashboard agent calls 401) | fresh-install local-API stale token map — known open issue | `systemctl restart felhom-agent`, then retry (this is why D.1b restarts the agent first) |
|
||||
| self-update fails: "Agent swap request failed: HTTP 401" (or dashboard agent calls 401) | agent < v0.63.0: the daemon's token index missed a token minted by the provisioner after it started (FIXED in agent v0.63.0 — reload-on-miss) | `systemctl restart felhom-agent`, then retry (D.1b step 1; unnecessary from agent v0.63.0) |
|
||||
| `local-lvm free < 120 GiB` warning | small/shared box | proceed only if you sized the grows deliberately; otherwise free space first |
|
||||
| cloudflared restarting in-guest | bad/missing tunnel token | re-check A.1/A.2 token, regenerate config, `docker restart cloudflared` in-guest |
|
||||
|
||||
|
||||
@@ -1,5 +1,14 @@
|
||||
# Felhom scripts — Changelog
|
||||
|
||||
## docs — day0-install D.1b narrowed + drill ledger B2/B3 → FIXED agent v0.63.0 (2026-07-03)
|
||||
|
||||
Agent v0.63.0 fixed both drill findings (B3 token reload-on-miss + B2 guesthook snippets-dir
|
||||
mkdir; red-proofed, deployed on felhom-pve, Gitea-published sha256 b4a89c81…). Guide follow-through:
|
||||
the D.1b "restart the agent first" step is now CONDITIONAL (only for an installed agent < v0.63.0 —
|
||||
the Day-0 manifest still vouches 0.62.0, so today's fresh installs still hit it); the 401
|
||||
troubleshooting row records the fix version; the drill ledger + go/no-go item 8 marked FIXED.
|
||||
Operator follow-up unchanged: vouch agent 0.63.0 in the Day-0 manifest UI, then the step is dead.
|
||||
|
||||
## felhom-host-install.sh v1.9.1 — clean-room drill fixes: residue-free uninstall + post-provision reboot (2026-07-03)
|
||||
|
||||
Companion to the Day-0 go-live package (`documentation/runbooks/day0-install.md` +
|
||||
|
||||
Reference in New Issue
Block a user