admin
89a2e508a7
Operator-run Day-0 automation for a fresh PVE host: pveum token -> hub POST /host-enroll (single secret, option C) -> agent config -> felhom-agent --selftest=provision -> verify. Idempotent/resumable (state.json), --dry-run, --resume, --force, --preserve-from; --mode dr is a documented 10D stub. Live-validated on felhom-pve: authorized wipe of demo guest 9201 + full re-provision from the golden -> controller config-pull + public tunnel HTTP 200 + host-report of 9201; idempotent --resume no-op. Found+fixed one ordering bug during the run (token ACL must be applied AFTER token rotation — token-remove purges the ACL). Adds scripts/README.md (operator runbook) + scripts/CHANGELOG.md; REPORT overwritten; spike doc pointer added. No service code changed. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TtXesNa2LGbMmE4DNL6SE7
30 lines
2.1 KiB
Markdown
30 lines
2.1 KiB
Markdown
# Felhom scripts — Changelog
|
|
|
|
## felhom-host-install.sh v1.0.0 — Day-0 host bootstrap (provision mode) (2026-06-26)
|
|
|
|
First release. A single operator-run script that automates Day-0 on a freshly-PVE-installed
|
|
host: Proxmox API token → hub host enrollment (option C, single secret) → agent config →
|
|
guest provision → verify. Composes proven mechanisms (the `pveum` role/token sequence, hub
|
|
`POST /host-enroll`, `felhom-agent --selftest=provision`); grounded by
|
|
`documentation/audits/SPIKE-day0-firstboot-handshake-2026-06-26.md`.
|
|
|
|
- **7 steps, idempotent + resumable** via `/var/lib/felhom-install/state.json`: pre-flight →
|
|
Proxmox token → compute grows → host-enroll → agent config → provision → verify.
|
|
- **Single-secret** (the retrieval passphrase): read no-echo or from a 0600 file, never on
|
|
argv/logs/state. The global operator key never touches the box.
|
|
- **pveum automation:** 16-priv `FelhomAgent` role (create-or-modify), `felhom-agent@pve` user,
|
|
privsep token (reuse-if-working else rotate), and **both** ACL grants applied **after** the
|
|
token exists (token-remove purges the token ACL).
|
|
- **Auto-discovery:** golden archive (newest `vzdump-lxc-<golden-vmid>`), PVE node name, vmbr0
|
|
bridge IP for the local-api, and the served-leaf TLS fingerprint pin.
|
|
- **Safety:** pre-flight fails fast (root, PVE 9.x, local-lvm headroom, hub reachable,
|
|
customer+passphrase valid via read-only `GET /config/{id}`, golden resolvable); refuses to
|
|
clobber an existing `--vmid` without `--force`; `--dry-run` previews every mutation;
|
|
`--preserve-from` keeps operator infra (PBS/local_api/privileged/authz) on re-deploys.
|
|
- **`--mode dr`:** documented 10D stub (restore customer PBS snapshot instead of golden) — not
|
|
implemented.
|
|
- **Live-validated** end-to-end on `felhom-pve`: authorized wipe of demo guest 9201 →
|
|
re-provision from the golden → controller config-pull + public tunnel `HTTP 200` →
|
|
host-report of guest 9201 → idempotent `--resume` no-op. (One ordering bug — token ACL
|
|
applied before rotation — was found and fixed during the live run.)
|