admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: ISO train v1.25.0 — REPORT (belt/apt/R-63/gate/vault live), F9 resolved, R-63 shipped, nodes belt+vault, F8 checklist; critical golden<floor finding

Browse Source 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NKSN3gSg4TKVBBqkwW2djR
This commit is contained in:
authentik Default Admin
2026-07-23 15:48:01 +02:00
parent b620435afe
commit 6dab0f6a2c
6 changed files with 132 additions and 80 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/operations/nodes.md
+30
View File
@@ -83,6 +83,36 @@ may be trying to fix. Slice 1 is to emit the baked password into the build repor
`demo-hp-lan` (`192.168.0.87` via `ProxyJump felhom-pve`) is the fallback while the box is away.
## OOB belt (H1) — both boxes, since 2026-07-23 (ISO train v1.25.0)
The dedicated OOB sshd belt (TASK H1: `felhom-sshd` + the static `inet felhom_oob` table + `felhom-op`)
is installed and **active on BOTH fleet boxes** — the F9 gap (belt on neither) is closed. From
v1.25.0 host-install installs it by default on every appliance install (`--no-oob` opts out; byo still
refuses).
- **Claimed port: `8822` on both** (first-free from `[8822,2222,8022,62222]`; persisted per box).
- **Reachability: the wg-felhom offsite tunnel ONLY** — the belt admits the operator `/32`
(`10.77.0.250`) over `wg-felhom` to 8822 and drops everything else; `:22` and every other interface
are untouched. **tailscale does NOT reach the belt** (wrong fabric, dropped by design).
- **Operator login** (from the machine holding the wg-felhom operator tunnel + the registered
`oob_operator_ssh_pubkey`): `ssh -p 8822 felhom-op@10.77.0.2` (felhom-pve) / `@10.77.0.3` (demo-hp).
**PROVEN live 2026-07-23** on felhom-pve (`felhom-op@demo-felhom`).
- **Operator tunnel**: the Mac/Windows operator peer dials `ep0.felhom.eu:443` (WireGuard), address
`10.77.0.250/32`, AllowedIPs `10.77.0.0/24`, server pubkey `f3d1ZI7…`. ep0's `forward` chain
(persisted in its `/etc/nftables.conf`) allows `10.77.0.250 → 10.77.0.2/.3`. If a work-network blocks
UDP/443, the RheinMetall-style firewalls pass UDP/51820 — a home/hotspot network works on 443.
- Register/rotate the operator identity hub-side: `PUT /api/v1/admin/wg/operator-peer` (global key)
with `{pubkey, assigned_ip:"10.77.0.250", ssh_pubkey}`; wgsync pushes it to ep0 and the SSH key flows
to both boxes' `felhom-op` authorized_keys within a tick.
## felhom-pve (the N100) — vault parity + access
felhom-pve has **operator SSH-key access** (over tailscale `100.70.170.35`) AND, since 2026-07-23,
**G1 break-glass vault parity with demo-hp**: its root@pam password is freshly rotated and vaulted in
the hub `host_recovery` row **`demo-felhom-8363b5`** (same PUT `…/recovery-credential` mechanism day-0
uses; verified retrievable + authenticating over `:22`). Retrieval + shred-the-copy recipe is identical
to demo-hp's below (swap the host_id). So a lost N100 key is recoverable the same way as the key-less HP.
## Tailscale on demo-hp is an OPERATOR-LAB EXCEPTION
> **Read this before any product-shape audit.** `demo-hp` is **customer-shaped** — it is a normal