admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: R-59/R-60/R-61 from the HP install + second-hardware pairing proof

Browse Source 
R-59 no-DHCP install must hard-abort (it baked 192.168.100.2 static and
completed - a box that can never call home). R-60 first-boot NIC sweep
self-heal. R-61 the baked root password must be knowable; a fixed well-known
password is explicitly rejected.

Positive evidence same-session: R-21 slice C PROVEN on a SECOND, virgin board
(HP t740) - and the shim loader booted with Secure Boot ENABLED, retiring the
assumption that Felhom installs need SB off. Fresh-box floor lift
0.153.0 -> 0.156.0 during day-0 cited on the publish-train row.

ISO README gains the t740 five-NIC trap: the 4-port igb card gets no lease,
the onboard r8169 port does.
This commit is contained in:
authentik Default Admin
2026-07-21 18:44:54 +02:00
parent 59226edb3e
commit 460cc73bad
3 changed files with 25 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/iso/README.md
+19 -2
View File
@@ -144,8 +144,10 @@ producer steps re-run each pass).
default stays at the stock signed `shim`**, so Secure Boot keeps working. `mkimage` exists only to
work around the N100's AMI firmware GRUB defect and is unsigned.
**PROVEN on this board (safety boot, operator-photographed 2026-07-21):** the shim loader booted, the
answer file was fetched and parsed, and the match-nothing filter refused with **zero disk writes** —
**PROVEN on this board (2026-07-21):** the safety boot loaded shim, fetched and parsed the answer file,
and the match-nothing filter refused with **zero disk writes**; the armed ISO then installed end to end.
**Secure Boot stayed ENABLED throughout** (`mokutil --sb-state` on the installed box → `SecureBoot
enabled`) — so SB-off is an N100-firmware workaround, not a Felhom requirement.
so the loader, Secure Boot setting, and network/answer path are all confirmed before anything
destructive existed on a stick. `enp1s0f0` auto-detect verified on-board.
@@ -158,6 +160,21 @@ from the written stick — the profile is what you intended, the ISO is what you
osirrox -indev <iso> -extract /answer.toml /tmp/a.toml && sed -n '/^\[disk-setup\]/,$p' /tmp/a.toml
```
**t740 NIC TRAP — the 4-port card gets no DHCP; use the onboard port.** This board presents FIVE
wired NICs and the install picks wrong:
| interface | driver | what it is | at this site |
|---|---|---|---|
| `enp1s0f0`–`f3` | `igb` | the 4-port expansion card | **no DHCP lease** (no link) |
| `enp2s0f0` | `r8169` | **the onboard port** | leases fine, 1000 Mb |
| `wlo1` | `iwlwifi` | wifi | unused |
Plug the cable into the **onboard** port. If the install already happened on the wrong port, the
symptom is nasty: the installer does not abort, it bakes its **192.168.100.2 fallback as a STATIC
`vmbr0` address** and completes, so the box looks installed and can never reach the hub (R-59).
Repair on the console: point `bridge-ports` at `enp2s0f0` in `/etc/network/interfaces`, set the
correct address (or `dhcp`), `ifreload -a`. R-60 is the self-heal that would make this unnecessary.
**Confirm the serial is the system disk and not a data drive.** On this board the SanDisk X600 128GB
(`sda`) is the system disk; the 1TB NVMe is the future data drive and must stay OUTSIDE the filter —
it joins later through the normal Tárhely flow, not the installer.