admin/felhom.eu
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

scripts: felhom-host-install.sh v1.0.0 — Day-0 host bootstrap (live-validated)

Browse Source 
Operator-run Day-0 automation for a fresh PVE host: pveum token -> hub
POST /host-enroll (single secret, option C) -> agent config -> felhom-agent
--selftest=provision -> verify. Idempotent/resumable (state.json), --dry-run,
--resume, --force, --preserve-from; --mode dr is a documented 10D stub.

Live-validated on felhom-pve: authorized wipe of demo guest 9201 + full
re-provision from the golden -> controller config-pull + public tunnel HTTP 200
+ host-report of 9201; idempotent --resume no-op. Found+fixed one ordering bug
during the run (token ACL must be applied AFTER token rotation — token-remove
purges the ACL).

Adds scripts/README.md (operator runbook) + scripts/CHANGELOG.md; REPORT
overwritten; spike doc pointer added. No service code changed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TtXesNa2LGbMmE4DNL6SE7
This commit is contained in:
authentik Default Admin
2026-06-26 20:04:25 +02:00
parent 15397468df
commit 89a2e508a7
5 changed files with 776 additions and 74 deletions
Download Patch File Download Diff File Expand all files Collapse all files
documentation/audits/SPIKE-day0-firstboot-handshake-2026-06-26.md
+6
View File
@@ -182,6 +182,12 @@ scope — the `customerID` (path param) and the `h.store` handle (which exposes
> hub `CHANGELOG.md` v0.14.0 + `README.md` "Host Enrollment (Day-0, option C)". The route is the exact
> `path == "/host-enroll"` form (not `/hosts/enroll`, which would collide with the `/hosts/` per-host
> prefix routes).
>
> **UPDATE 2026-06-26 — Day-0 host-bootstrap script SHIPPED.** This gap inventory is now implemented
> end-to-end by `scripts/felhom-host-install.sh` v1.0.0 (provision mode): pveum token → `host-enroll`
> → agent config → `--selftest=provision` → verify. Live-validated by an authorized wipe + re-provision
> of demo guest 9201 (controller config-pull + public tunnel `HTTP 200` + host-report confirmed). DR
> mode is a documented stub (10D). See `scripts/README.md` + `REPORT.md`.
**Recommendation:** ship **Option A now** (it is proven and needs nothing). Adopt **Option C, variant
(c-pref) — a dedicated passphrase-authed `host-enroll` endpoint, mint-once-reuse — at the production