admin
00afadc1fe
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6
36 lines
3.1 KiB
Markdown
36 lines
3.1 KiB
Markdown
# felhom.eu — task reports
|
|
|
|
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
|
|
|
|
## SPIKE — PBS DR tier auto-provisioning, SLICE 0: the three load-bearing mechanisms — 2026-07-10
|
|
|
|
**No production code — findings record at
|
|
`documentation/audits/SPIKE-pbs-tier-provisioning-2026-07-10.md`.** All three unproven mechanisms of the
|
|
"PBS DR tier" epic got empirical answers; every probe artifact was `spike-*`-named and torn down (asserted);
|
|
the demo's real `felhom-offsite`/`felhom-pbs` storages re-verified active afterwards. Viktor approved the
|
|
one 🛑 (the ep0 touch) mid-run.
|
|
|
|
- **Probe 1 (demo host): path-scoped token create is IMPOSSIBLE.** `POST/PUT/DELETE /storage*` all 403 with
|
|
`Permission check failed (/storage, Datastore.Allocate)` — the whole entry-lifecycle CRUD checks the
|
|
`/storage` ROOT; `/storage/<id>` ACLs govern usage only. **Probe 1b settled the fallback:** a pinned-id
|
|
sudoers alias (`pvesm add/set/remove <id>`, `pveum acl modify /storage/<id>`) — full cycle green as the
|
|
`felhom-agent` user via `sudo -n`, unpinned id denied. Gotcha: sudo logs argv → the token secret must go
|
|
through a stdin-reading root wrapper, never `sudo pvesm add --password …`.
|
|
- **Probe 2 (ep0, 🛑): the tenancy op-set + secret transport PROVEN.** Recon recorded the surface (one
|
|
`restrict`+forced-command key, one sudoers line; the peersync user can sudo nothing else — live-proven).
|
|
Throwaway `spike-tenant` on the real `felhom-offsite`: namespace + privsep token + dual-grant, the token
|
|
secret returned over SSH stdout (36 bytes, never persisted on ep0, never displayed), S4 isolation asserts
|
|
green incl. a real cross-tenant WRITE 403. Ordering gotchas recorded (token-before-ACL; delete-token purges
|
|
its ACLs; no `--output-format` on generate-token). Slice-1 recommendation: a second forced-command surface
|
|
(`felhom-tenantsync`, own keypair + sudoers line), peersync untouched.
|
|
- **Probe 3 (demo host): `pvesm add pbs … --encryption-key autogen` works end-to-end.** Entry active, K born
|
|
at `/etc/pve/priv/storage/<id>.enc` (0600, = `PBSEncKeyPath` on demo), vzdump of a small guest lands as
|
|
**ciphertext** PBS-side (`crypt-mode: encrypt` — the doc-06 property), `escrow-create` would find K.
|
|
**⚠ `pvesm remove` DELETES the `.enc` (K!) + `.pw`** → the epic's re-apply must be `pvesm set`-only.
|
|
- **Flags surfaced (pre-existing):** orphan `root@pam!spike` DatastoreAdmin on ep0 `/datastore/scratch`;
|
|
the demo host is missing the §4b step-3 `/storage/felhom-pbs|felhom-offsite` FelhomAgentStore grants
|
|
(backups still green — needs a deliberate re-assert before slice 2 codifies the self-grant); 180's
|
|
`felhom@pbs!n100` is datastore-wide DatastoreAdmin (dev-grade, don't copy).
|
|
- **Epic slice map** (hub tenantsync + consume-once → agent apply-bridge with stdin-wrapper + set-only
|
|
re-apply → DR schedule/monitoring → Peti ceremony one-liner) in the record §5.
|