DRILL-day0-vm 2026-07-12: full report + runbook corrections (F-4/F-6 headline findings)
Audit doc for the Day-0 VM drill: appliance install, floor-at-first-report, escrow ceremony + auto-confirm FIRST LIVE FIRING (~7.5 min, zero clicks), offsite backup + restore round-trip, PBS-DR/WG fork (Peti-sequence rehearsal). Corrects day0-install.md A.2 (git creds optional since v1.11.2, anonymous fetch is the normal shape) and RUNBOOK-escrow-ceremony.md (identity-only mode does NOT exist — F-6; age prereq — F-10). REPORT.md overwritten; CONTEXT.md one-liner added. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01NptTCFtu7dz2Ru89qHRagN
This commit is contained in:
@@ -18,8 +18,15 @@
|
||||
|
||||
## Prerequisites (check BEFORE scheduling with the customer)
|
||||
- **Agent version:** ≥ v0.79.0 (the ceremony records `restic_pw_sha256` — older agents produce a blob
|
||||
auto-confirm can never match). **No-PBS hosts** (BYO without the PBS tier): ≥ **v0.80.0**
|
||||
(identity-only mode; below that the ceremony hard-requires the PBS key and refuses).
|
||||
auto-confirm can never match).
|
||||
- **⚠ No-PBS hosts: the ceremony CANNOT run.** The previously documented "identity-only mode
|
||||
(≥ v0.80.0)" was NEVER implemented — v0.80.0's actual feature was seeding `escrow.pbs_storage_id`
|
||||
on PBS hosts. `escrow-create` hard-requires a PBS storage id + its key file (drill-proven
|
||||
2026-07-12, finding F-6 of DRILL-day0-vm-2026-07-12.md). Until identity-only ships, a box MUST
|
||||
have the PBS DR tier (which itself requires the WG tunnel peer first) before any escrow/offsite
|
||||
arc can complete.
|
||||
- **Host packages:** `age` must be installed (identity wrap dependency; NOT installed by
|
||||
host-install as of v1.14.0 — drill finding F-10). `apt-get install -y age`.
|
||||
- **K gate (PBS hosts):** `escrow.pbs_storage_id` set and the key file present
|
||||
(`cfg.Backup.PBSEncKeyPath(<id>)`).
|
||||
- **Staged secret (offsite):** offsite enabled → `EscrowState="pending"` on the controller and the staged
|
||||
@@ -31,8 +38,9 @@
|
||||
```bash
|
||||
felhom-agent --selftest=escrow-create --upload
|
||||
```
|
||||
- `--storage <pbs-storage-id>` only if `escrow.pbs_storage_id` isn't configured. No-PBS hosts (agent
|
||||
≥0.80.0): omit — identity-only engages automatically.
|
||||
- `--storage <pbs-storage-id>` only if `escrow.pbs_storage_id` isn't configured (the PBS DR
|
||||
apply-bridge seeds it automatically). No-PBS hosts: see the prerequisite warning above — the
|
||||
ceremony refuses without a PBS key; identity-only mode does not exist yet.
|
||||
- What it does, in order: generates a fresh **R** (EFF-wordlist passphrase; entropy printed) → seals K
|
||||
(if present, via proxmox-backup-client re-key) and the IdentityBundle (age-under-R; the staged restic
|
||||
password auto-injected; the live WG key auto-captured if present) → **self-verifies by recovering its
|
||||
|
||||
@@ -63,8 +63,8 @@ Hub UI (`https://hub.felhom.eu`, operator password) → **Customers → New**:
|
||||
| Email | customer's email | used for customer-tier notifications (Hungarian) |
|
||||
| CF tunnel token | from A.1 | → `infrastructure.cf_tunnel_token` |
|
||||
| CF API token | from A.1 (optional) | → `infrastructure.cf_api_token` (geo rules) |
|
||||
| Git username | Gitea read account | → `git.username` — **required for Day-0** |
|
||||
| Git token | Gitea read token | → `git.token` — **required for Day-0**: the install script and the controller fetch artifacts from Gitea with this credential; without it the install dies at step 5/8 |
|
||||
| Git username | Gitea read account | → `git.username` — **optional** (only for a private app catalog) |
|
||||
| Git token | Gitea read token | → `git.token` — **optional** since installer v1.11.2 (the G3 ruling): artifacts are world-readable and fetched ANONYMOUSLY, sha256-verified against the hub manifest. Empty is the normal customer shape; expect the installer's "fetching artifacts ANONYMOUSLY" warn line in steps 5/8 (drill-verified 2026-07-12 on the VM Day-0 drill). |
|
||||
|
||||
On save the hub generates two credentials:
|
||||
|
||||
@@ -405,7 +405,7 @@ recovery credential).
|
||||
| byo dies: "acl storage(s) not found on this box" | `--acl-storages` names a storage the box lacks | pass the box's real storages (check `pvesm status`) |
|
||||
| step 1 dies: "this is a N-node cluster" | multi-node cluster | re-run with `--node <name>` |
|
||||
| step 5 dies: "hub artifact manifest has no agent version" | Day-0 manifest unset/incomplete | Part A.3 — set it in the operator UI |
|
||||
| step 5 dies: "no git token in controller.yaml" | customer created without git credentials | Part A.2 — add `git.username`/`git.token`, regenerate config |
|
||||
| step 5 warns: "no git credential — fetching artifacts ANONYMOUSLY" | customer has no git credentials — the NORMAL shape since installer v1.11.2 | nothing to do; sha256 verification is unchanged. (Pre-v1.11.2 installers die here instead — upgrade the script.) |
|
||||
| step 1: passphrase REJECTED (401) | typo / wrong customer | re-check with the hub UI's printed curl command |
|
||||
| step 8 fails: "CT <vmid> already exists" | vmid collision with a hub-invisible guest | pick from `pct list` + `qm list` (Part B); the agent destroys nothing on collision — re-run with a free vmid and `--resume` |
|
||||
| controller container missing in-guest after provision (docker ps empty) | golden older than 0.98.3 (no baked path unit) + pre-v1.9.1 script: the controller-bootstrap unit's boot-time condition lost the race with the bootstrap-mount attach | `pct reboot <VMID>` — the unit runs on the next boot (v1.9.1 reboots itself; goldens ≥ 0.98.3 bake a path unit that starts the controller on the mount hot-plug, no reboot needed) |
|
||||
|
||||
Reference in New Issue
Block a user