admin
89a2e508a7
Operator-run Day-0 automation for a fresh PVE host: pveum token -> hub POST /host-enroll (single secret, option C) -> agent config -> felhom-agent --selftest=provision -> verify. Idempotent/resumable (state.json), --dry-run, --resume, --force, --preserve-from; --mode dr is a documented 10D stub. Live-validated on felhom-pve: authorized wipe of demo guest 9201 + full re-provision from the golden -> controller config-pull + public tunnel HTTP 200 + host-report of 9201; idempotent --resume no-op. Found+fixed one ordering bug during the run (token ACL must be applied AFTER token rotation — token-remove purges the ACL). Adds scripts/README.md (operator runbook) + scripts/CHANGELOG.md; REPORT overwritten; spike doc pointer added. No service code changed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TtXesNa2LGbMmE4DNL6SE7
2.1 KiB
2.1 KiB
Felhom scripts — Changelog
felhom-host-install.sh v1.0.0 — Day-0 host bootstrap (provision mode) (2026-06-26)
First release. A single operator-run script that automates Day-0 on a freshly-PVE-installed
host: Proxmox API token → hub host enrollment (option C, single secret) → agent config →
guest provision → verify. Composes proven mechanisms (the pveum role/token sequence, hub
POST /host-enroll, felhom-agent --selftest=provision); grounded by
documentation/audits/SPIKE-day0-firstboot-handshake-2026-06-26.md.
- 7 steps, idempotent + resumable via
/var/lib/felhom-install/state.json: pre-flight → Proxmox token → compute grows → host-enroll → agent config → provision → verify. - Single-secret (the retrieval passphrase): read no-echo or from a 0600 file, never on argv/logs/state. The global operator key never touches the box.
- pveum automation: 16-priv
FelhomAgentrole (create-or-modify),felhom-agent@pveuser, privsep token (reuse-if-working else rotate), and both ACL grants applied after the token exists (token-remove purges the token ACL). - Auto-discovery: golden archive (newest
vzdump-lxc-<golden-vmid>), PVE node name, vmbr0 bridge IP for the local-api, and the served-leaf TLS fingerprint pin. - Safety: pre-flight fails fast (root, PVE 9.x, local-lvm headroom, hub reachable,
customer+passphrase valid via read-only
GET /config/{id}, golden resolvable); refuses to clobber an existing--vmidwithout--force;--dry-runpreviews every mutation;--preserve-fromkeeps operator infra (PBS/local_api/privileged/authz) on re-deploys. --mode dr: documented 10D stub (restore customer PBS snapshot instead of golden) — not implemented.- Live-validated end-to-end on
felhom-pve: authorized wipe of demo guest 9201 → re-provision from the golden → controller config-pull + public tunnelHTTP 200→ host-report of guest 9201 → idempotent--resumeno-op. (One ordering bug — token ACL applied before rotation — was found and fixed during the live run.)