docs: GL-8 wrap — runbook F3/F6 notes, findings FIXED, REPORT, decision log
day0-install: F3 (no --allow-new-leaf on a populated BYO host) + F6 (:53 must be free, refusal + remediation). GO-LIVE-PACKAGE + DRILL-GL6 ledger flip F1/F3/F6 -> FIXED v1.12.0; GL-7 unblocked; F2/F7 stay open. CONTEXT + REPORT. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
This commit is contained in:
@@ -361,11 +361,11 @@ plain-umount busy-drive handling, self-update-artifact removal, **data intact ×
|
||||
| ID | Sev | What | Status |
|
||||
|----|-----|------|--------|
|
||||
| **F4** | HIGH | `--resume` skipped producer steps → config missing hub.host_id/proxmox.token (daemon crash-loop) + provision `-rootfs-grow ""` | **FIXED v1.11.3, live-proven** (dry + the single-shot appliance install) |
|
||||
| F1 | MED | `/etc/felhom-agent/` + `agent.json.bak-*` (secret-bearing) survive uninstall when prior `.bak` configs exist | open — purge config dir/.bak in uninstall 4b |
|
||||
| F1 | MED | `/etc/felhom-agent/` + `agent.json.bak-*` (secret-bearing) survive uninstall | **FIXED v1.12.0 (GL-8)** — uninstall purges `${agent_cfg}.bak*` |
|
||||
| F2 | MED | per-drive `mnt-*.mount` units + `/mnt/<name>` primary mounts survive uninstall ("physically removable" overclaims) | open — uninstall stop+remove the agent's `mnt-*` units |
|
||||
| F3 | MED | byo FRESH install on a host with the OWNER's guests trips the populated-host leaf guard (`pct list | grep -q .`), needs `--allow-new-leaf` | GL-7 command + candidate guard-narrow to `felhom_guests` |
|
||||
| F3 | MED | byo FRESH install on a host with the OWNER's guests trips the populated-host leaf guard (`pct list`), needs `--allow-new-leaf` | **FIXED v1.12.0 (GL-8)** — guard narrowed to `felhom_guests` |
|
||||
| F5 | — | initial "public dashboard DNS absent" — **MISDIAGNOSIS**: the `*.demo-felhom.eu` wildcard works (HTTP 200 via DoH); real cause was F6 | superseded by F6 |
|
||||
| F6 | MED | leftover **broken dnsmasq** (active on `:53`, queries time out) on a byo host (`lan_resolver` off) breaks LAN-client DNS | open — byo install/uninstall stop+mask leftover dnsmasq |
|
||||
| F6 | MED | leftover **broken dnsmasq** (active on `:53`) on a byo host breaks LAN-client DNS | **FIXED v1.12.0 (GL-8)** — byo preflight REFUSES a foreign `:53` + instructs (no mutation; Viktor ruling); live-proven |
|
||||
| F7 | MED | R2 pool re-assertion is **bring-up-only** (`bringup.go:498`); no continuous membership reconcile → out-of-band drift doesn't auto-heal (repair via `--adopt-pool`) | open — candidate periodic membership reconcile |
|
||||
| — | LOW | re-provision changes the guest DHCP IP (.105→.139) → manual LAN DNS entries go stale | GL-7 note (reserve lease / use lan_resolver) |
|
||||
| — | LOW | legacy `felhom-agent.v*.bak` binaries survive the uninstall `.bak-*` glob | trivial (demo-box history only) |
|
||||
|
||||
@@ -9,6 +9,7 @@ catalog `2ebe082a` · felhom.eu `1a1e42ad`/hub v0.35.0 · host-install v1.9.1 ·
|
||||
**Updated 2026-07-07 (GL-2 shipped):** felhom.eu `02d63ed0` · host-install **v1.10.0** + `scripts/hostinstall-mode-harness.sh`.
|
||||
**Updated 2026-07-08 (GL-4 + GL-5 shipped):** felhom.eu `f7cc6a72` · host-install **v1.11.0** (uninstall gap-closure + key-pin plumbing) · felhom-agent **v0.75.0** (DR bind overrides, live on felhom-pve).
|
||||
**Updated 2026-07-08 (GL-5b shipped):** felhom-agent **v0.76.0** live + PUBLISHED (`9828c5f7…f50b`) — restore-test full-fidelity + mount parity (new G12); the manifest bump target is now 0.76.0.
|
||||
**Updated 2026-07-08 (GL-8):** felhom.eu `18a556a5` · host-install **v1.12.0** — BYO coexistence: F3 (leaf guard narrowed to Felhom guests → no `--allow-new-leaf` on a populated BYO host), F6 (byo refuses a foreign `:53`, never mutates), F1 (uninstall purges config `.bak*`). F6 live-proven on felhom-pve; harness 36/36. **GL-7 unblocked** (Peti's command needs no workaround).
|
||||
**Updated 2026-07-08 (GL-6 DRILL COMPLETE):** felhom.eu `87ba30ae` · host-install **v1.11.3** (F4 resume fix shipped mid-drill; v1.11.2 anon-fetch ruling). Two full destroy/rebuild cycles on felhom-pve; manifest confirmed vouching agent 0.76.0 + golden 0.103.0. G2/G4/G5/G6/G7 LIVE-VALIDATED; G1 DONE; key-pin legs 1–4 proven. Record: `DRILL-GL6-2026-07-08.md`.
|
||||
|
||||
---
|
||||
@@ -89,6 +90,7 @@ BUNDLE cert/key/token migration item; hub-floor auto-update.
|
||||
| **GL-4** Uninstaller gap-closure + key-pin fold | ✔ **DONE 2026-07-08** (host-install v1.11.0, `f7cc6a72`) | felhom.eu/scripts | G6 + G1-plumbing | GL-2 |
|
||||
| **GL-5** DR bind-override | ✔ **DONE 2026-07-08** (agent v0.75.0, `b3446213`, live-validated) | felhom-agent | G8 | — |
|
||||
| **GL-6** Demo-box drill | ✔ **DONE 2026-07-08** (`DRILL-GL6-2026-07-08.md`; F4 fix v1.11.3 mid-drill) | felhom.eu/scripts (v1.11.3) | G7 | GL-1, GL-2, GL-4 |
|
||||
| **GL-8** BYO coexistence hardening | ✔ **DONE 2026-07-08** (v1.12.0, `18a556a5`; F3/F6/F1) | felhom.eu/scripts | F3/F6/F1 | GL-6 |
|
||||
| **GL-7** Peti day-0 runbook + onboarding | **NEXT** (GL-6 green) | felhom.eu/documentation/pilot | G9, G10, G11 + findings F1/F2/F3/F6/F7 | GL-6 green |
|
||||
|
||||
Recommended order: **GL-1 and GL-3 immediately** (operator-heavy, unblock everything), GL-2 next
|
||||
@@ -159,16 +161,27 @@ Recommended order: **GL-1 and GL-3 immediately** (operator-heavy, unblock everyt
|
||||
installer follow-up (none block Peti). G2/G4/G5/G6/G7 → LIVE-VALIDATED; G1 → DONE; G9 → deferred
|
||||
to GL-7; G10 (open dashboard until operator password) → GL-7 prerequisite.
|
||||
|
||||
- 2026-07-08 — **GL-8 SHIPPED** (host-install **v1.12.0**, felhom.eu `18a556a5`): BYO coexistence
|
||||
hardening from the GL-6 findings — **F3** leaf guard narrowed to `felhom_guests` (Peti's fresh
|
||||
install on his populated box needs no `--allow-new-leaf` — the reason GL-8 shipped BEFORE GL-7),
|
||||
**F6** byo preflight REFUSES a foreign `:53` with a remediation message (**Viktor's ruling: refuse
|
||||
+ instruct, NO stop/mask — Felhom does not mutate a DNS service on a host it doesn't own**; the
|
||||
break-glass analog), **F1** uninstall purges the config `.bak*` siblings (a GL-6 residue held a
|
||||
live hub api_key). F6 **live-proven** on felhom-pve (byo preflight refuses at :53 — the exact
|
||||
GL-6 scenario). Harness 36/36 + red-proofs RP-F3/F6/F1; GL-2/GL-4 regression green. F2/F7 remain
|
||||
open (non-blocking). **GL-7 unblocked.**
|
||||
|
||||
## 6. Open questions & operator actions
|
||||
|
||||
**Operator actions (Viktor):**
|
||||
- **Hub manifest bump — DONE** (confirmed at GL-6 Phase 0: the manifest vouches agent `0.76.0` +
|
||||
golden `0.103.0`). No action.
|
||||
- **Small installer follow-up (GL-6 findings, none block Peti)** — a v1.11.4 pass:
|
||||
F1 (purge `/etc/felhom-agent` + `agent.json.bak-*` on uninstall), F2 (stop+remove the agent's
|
||||
per-drive `mnt-*.mount` units on uninstall), F3 (narrow the populated-host leaf guard to
|
||||
`felhom_guests`, or document `--allow-new-leaf` in the byo command), F6 (stop+mask the leftover
|
||||
broken dnsmasq on a byo host), F7 (optional periodic pool-membership reconcile).
|
||||
- **Installer findings — F1/F3/F6 FIXED in host-install v1.12.0 (GL-8, `18a556a5`).** F3: leaf guard
|
||||
narrowed to `felhom_guests` (fresh byo install on a populated host needs no `--allow-new-leaf`).
|
||||
F6: byo preflight REFUSES a foreign `:53` with remediation (Viktor's ruling — no stop/mask; live-
|
||||
proven on felhom-pve). F1: uninstall purges config `.bak*` siblings. **Still open (none block
|
||||
Peti):** F2 (per-drive `mnt-*.mount` units survive uninstall), F7 (pool re-assert is bring-up-only
|
||||
— no continuous heal; `--adopt-pool` repairs). A later small pass, or fold into a future task.
|
||||
- **Gitea visibility ruling** (new, see G3): decide deliberately — (a) keep felhom repos public
|
||||
as an open-source posture, but audit + privatize `homelab-manifests` and the personal repos;
|
||||
or (b) lock the instance, which REQUIRES first proving the day-0 package fetch with a
|
||||
|
||||
@@ -240,8 +240,18 @@ What byo does differently (everything else matches C.4's eight steps):
|
||||
- `--cores` AND `--memory` are **required** — size them WITH the owner (the guest must never starve
|
||||
the owner's guests). `--acl-storages` must name storages that actually exist on the box, or the
|
||||
preflight dies naming the missing ones.
|
||||
- Preflight additionally prints what already listens on the host's `:53` (informational — Felhom
|
||||
never configures DNS on a byo box) and the existing-guest count.
|
||||
- **The host's `:53` must be free** (v1.12.0/F6): Felhom publishes the guest by name on the LAN, so a
|
||||
resolver already bound to `:53` blocks it. byo preflight **REFUSES** (does not touch the owner's
|
||||
service — it is a refusal, not a change) with: *"a resolver is already bound to :53 … stop or
|
||||
reconfigure it, or point your LAN DNS at the guest's address, then re-run."* Clear `:53` (or point
|
||||
the owner's DNS at the guest) and re-run. (Appliance mode is different — there Felhom's own
|
||||
lan_resolver owns `:53`.)
|
||||
- **A fresh install on a populated BYO host Just Works** (v1.12.0/F3): the leaf-regeneration guard
|
||||
now fires only when a **Felhom** guest is already present — the owner's own non-Felhom guests no
|
||||
longer trip it, so **`--allow-new-leaf` is NOT needed** on a first install. (You still need
|
||||
`--preserve-state-from` / `--allow-new-leaf` on a reinstall over an existing *Felhom* guest, to
|
||||
protect its pinned fingerprint — unchanged.)
|
||||
- Preflight also prints the existing-guest count.
|
||||
- At the end of preflight the script prints the **complete host-mutation list** (pveum
|
||||
roles/user/token/ACL/pool, agent user/binary/unit/sudoers/config/state, the watchdog + guarded
|
||||
wrappers, the guest + golden) and requires typing the host's **short hostname** to proceed —
|
||||
|
||||
Reference in New Issue
Block a user