admin
a7e86fd273
gates / gates (push) Successful in 1m57s
Closed: R-1354, R-1347, R-1348, R-1339, R-1351, R-1323, R-1302, R-1352, R-1331, R-1356, R-1359 (235 -> 224). R-548 and R-1361 carry today's readings.
146 lines
10 KiB
Plaintext
146 lines
10 KiB
Plaintext
[INFO] auto-sized guest RAM: 5847 MiB (host 9943 MiB; clamp(host-4096, min 4096, max host-2048), ceiling host-1024)
|
|
[INFO] auto-sized guest cores: 5 (host 6 cores; host-1, min 2)
|
|
|
|
[INFO] felhom-host-install v1.36.1 — mode=appliance customer=Tester4 vmid=9201
|
|
|
|
[STEP] 1/8 pre-flight
|
|
[INFO] pve-manager/9.2.2/b9984c6d90a4bd80 (running kernel: 7.0.2-6-pve)
|
|
[INFO] node: box1103 (auto)
|
|
[INFO] agent config: /etc/felhom-agent/agent.json
|
|
[INFO] agent: not installed yet — will be fetched + installed in step 5/8
|
|
[INFO] local-lvm free: ~19 GiB
|
|
[WARN] local-lvm free ~19 GiB is below the recommended 120 GiB — the install continues; proceed only if you sized the grows deliberately
|
|
[INFO] free RAM: ~8151 MiB
|
|
[INFO] existing guests on this host: 0 (pct+qm)
|
|
[INFO] archive storage 'local' present
|
|
[INFO] acl storage 'felhom-pbs' not present yet — expected: the PBS-DR tier creates it; the grant is pre-positioned deliberately
|
|
[INFO] dnsmasq: not present before Felhom — recorded; uninstall will remove it again if we install it
|
|
[INFO] hub reachable (https://hub.felhom.eu)
|
|
[OK] customer 'Tester4' exists + passphrase valid
|
|
[INFO] golden: none local — will fetch + verify from Gitea in step 7/8
|
|
[OK] pre-flight passed
|
|
[STEP] 2/8 Proxmox API token
|
|
[OK] token minted (secret captured, not logged)
|
|
[OK] scoped ACL applied (Base@/, Guest@/pool/felhom + /vms/990000..990009, Store@[local local-lvm felhom-pbs])
|
|
[SKIP] old broad role FelhomAgent already absent
|
|
[STEP] 3/8 compute volume grows
|
|
[INFO] auto-computed from a 19 GiB thin pool (16 §7: 50/100/130 GiB)
|
|
[INFO] grows: rootfs +0G (->32G), data +26G (->50G, ONE volume)
|
|
[STEP] 4/8 host enrollment (POST /host-enroll)
|
|
[OK] host MINTED (first enroll)
|
|
[INFO] host_id: Tester4-e286d3 (api_key captured, not logged)
|
|
[STEP] 4b/8 break-glass credential (root@pam console password → hub vault)
|
|
[INFO] recovery password vaulted at the hub (stored) — now setting it on root@pam
|
|
[OK] root@pam password vaulted, set, and the PVE login takes it (retrieve via the operator /admin path; never logged here)
|
|
[WARN] NOTE: the root@pam password just CHANGED — the old one now fails at the PVE web GUI (:8006).
|
|
[WARN] Retrieve the new one at hub → host page (vaulted recovery credential).
|
|
[STEP] 5/8 agent install (fetch + verify + install)
|
|
[OK] apt repos aligned to no-subscription (already aligned; apt-get update OK)
|
|
[WARN] TEST 2026-11-03: the manifest's agent + golden replaced by the unvouched 0.172.0 + 0.350.0
|
|
[WARN] no git credential in controller.yaml — fetching artifacts ANONYMOUSLY (they are world-readable; sha256 verification unchanged)
|
|
[INFO] manifest: agent v0.172.0 (sha 2c0222cd01713f65…), golden v0.350.0
|
|
[INFO] fetching agent binary v0.172.0 from Gitea …
|
|
[OK] verified sha256 2c0222cd01713f65… matches the hub manifest
|
|
[OK] installed /usr/local/bin/felhom-agent (felhom-agent 0.172.0)
|
|
[OK] created service user felhom-agent
|
|
[OK] added felhom-agent to systemd-journal (unprivileged journal read for NAS verify)
|
|
[OK] verified sha256 cc34b0bc3346ffd6… matches the hub manifest
|
|
os-apply: BUNDLE START agent=0.172.0 sha=cc34b0bc3346ffd6 authority=installer files=32 write=31 same=1 kept=0 skipped=0
|
|
os-apply: BUNDLE WROTE /usr/local/sbin/felhom-mkfs-guarded (new)
|
|
os-apply: BUNDLE WROTE /usr/local/sbin/felhom-selfupdate-guarded (new)
|
|
os-apply: BUNDLE WROTE /usr/local/sbin/felhom-pbs-apply (new)
|
|
os-apply: BUNDLE WROTE /usr/local/sbin/felhom-backup-target-apply (new)
|
|
os-apply: BUNDLE WROTE /usr/local/sbin/felhom-vzdump-partial-clean (new)
|
|
os-apply: BUNDLE WROTE /usr/local/sbin/felhom-thin-check (new)
|
|
os-apply: BUNDLE WROTE /usr/local/sbin/felhom-internal-place (new)
|
|
os-apply: BUNDLE WROTE /usr/local/sbin/felhom-crash-guard (new)
|
|
os-apply: BUNDLE WROTE /usr/local/sbin/felhom-priv-apply (new)
|
|
os-apply: BUNDLE WROTE /var/lib/vz/snippets/felhom-guest-hook.sh (new)
|
|
os-apply: BUNDLE WROTE /usr/local/sbin/felhom-shared-parent.sh (new)
|
|
os-apply: BUNDLE WROTE /etc/systemd/system/felhom-shared-parent.service (new)
|
|
os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard.service (new)
|
|
os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard-check.service (new)
|
|
os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard-check.timer (new)
|
|
os-apply: BUNDLE WROTE /etc/felhom/crash-guard.conf (new)
|
|
os-apply: BUNDLE WROTE /etc/grub.d/01_felhom_oneshot (new)
|
|
os-apply: BUNDLE WROTE /etc/grub.d/42_felhom_oneshot (new)
|
|
os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent.service (new)
|
|
os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent-rollback.service (new)
|
|
os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent.service.d/felhom-agent-limits.conf (new)
|
|
os-apply: BUNDLE WROTE /usr/local/sbin/felhom-mgmt-watchdog (new)
|
|
os-apply: BUNDLE WROTE /etc/tmpfiles.d/felhom-privsep.conf (new)
|
|
os-apply: BUNDLE WROTE /etc/systemd/system/felhom-mgmt-watchdog.service (new)
|
|
os-apply: BUNDLE WROTE /etc/systemd/system/felhom-mgmt-watchdog.timer (new)
|
|
os-apply: BUNDLE WROTE /etc/systemd/system/felhom-sshd.service (new)
|
|
os-apply: BUNDLE WROTE /etc/felhom-oob.nft (new)
|
|
os-apply: BUNDLE WROTE /etc/systemd/system/felhom-oob-nft.service (new)
|
|
os-apply: BUNDLE WROTE /etc/ssh/sshd_config.d/10-felhom-root-key-only.conf (new)
|
|
os-apply: BUNDLE WROTE /etc/sudoers.d/felhom-op (new)
|
|
os-apply: BUNDLE WROTE /etc/sudoers.d/felhom-agent (new)
|
|
os-apply: BUNDLE DONE agent=0.172.0 written=31 same=1 self-check=ok signers-created=False
|
|
[OK] installed every root-owned file from config bundle v0.172.0 (sha cc34b0bc3346ffd6…; checked, previous copies kept)
|
|
[OK] OOB felhom-sshd instance + static belt from the bundle (agent renders config + fills sets once oob.enabled)
|
|
[STEP] 5b/8 internal data place (Belső tárhely)
|
|
[INFO] no internal place: only -79 GiB free for it (pool 19, reserve 16, promised 0, planned 82; needs 20)
|
|
[STEP] 6/8 agent config + service
|
|
[WARN] backup target: DEGRADED — no eligible second drive, so the whole-system backup stays on the SYSTEM drive.
|
|
[WARN] It protects against file corruption but NOT against a disk failure. Attach a second drive and assign it in the dashboard.
|
|
[INFO] island bridge vmbr9 already present — leaving it
|
|
[INFO] R-50 island ON: local_api=169.254.253.1:8443 (vmbr9); guest net1=169.254.253.2/30; lan_resolver.host_ip=192.168.0.126
|
|
[INFO] node=box1103 local_api=169.254.253.1:8443 tls_fp=DE:30:AC:4C:D2:A4…
|
|
[OK] wrote /etc/felhom-agent/agent.json (0600 felhom-agent)
|
|
[OK] agent --selftest (read-only) passed
|
|
[OK] felhom-agent service active (non-root felhom-agent reads the config OK)
|
|
[OK] wrote /etc/felhom/os-trust.json + operator-signers (felhom-op-1) — the root-owned slow-lane anchors
|
|
[STEP] 7/8 golden archive
|
|
[WARN] no git credential in controller.yaml — fetching artifacts ANONYMOUSLY (they are world-readable; sha256 verification unchanged)
|
|
[INFO] fetching golden v0.350.0 from Gitea → /var/lib/vz/dump/vzdump-lxc-9100-2026_11_03-10_09_43.tar.zst
|
|
[OK] verified sha256 082e2e040de56153… matches the hub manifest
|
|
[OK] golden imported + verified: local:backup/vzdump-lxc-9100-2026_11_03-10_09_43.tar.zst
|
|
[STEP] 8/8 provision guest 9201
|
|
[SKIP] pool felhom already exists
|
|
=== felhom-agent 0.172.0 selftest=provision (vmid=9201 customer=Tester4 hostname=tester4) ===
|
|
--- front half: bring-up (provision) local:backup/vzdump-lxc-9100-2026_11_03-10_09_43.tar.zst → vmid 9201 ---
|
|
time=2026-11-03T10:10:43.826+01:00 level=INFO msg="bring-up: pool membership re-asserted" vmid=9201 pool=felhom
|
|
[OK] front half: vmid 9201 up (boot+running) in 49s; MAC=BC:24:11:B8:6D:F6
|
|
--- back half: mint per-guest token + populate bootstrap config mount ---
|
|
time=2026-11-03T10:10:49.198+01:00 level=INFO msg="provision: back-half complete" vmid=9201 mount=mp9 guest_path=/etc/felhom-bootstrap endpoint=169.254.253.1:8443
|
|
[OK] back half: bootstrap mount mp9 → /etc/felhom-bootstrap on vmid 9201 (host dir /var/lib/felhom-agent/guests/9201/bootstrap)
|
|
local-api endpoint 169.254.253.1:8443 · leaf fp <long> · token: minted (not printed)
|
|
=== selftest=provision OK — guest 9201 provisioned + bootstrap-mounted (KEPT) ===
|
|
next: reboot the guest → the golden's baked controller-bootstrap unit deploys the controller,
|
|
which PULLS its controller.yaml from the hub (retrieval passphrase) and merges in this local_api.
|
|
[OK] provision completed
|
|
[INFO] rebooting guest 9201 so the baked controller-bootstrap unit picks up the mount
|
|
[STEP] verify
|
|
[OK] pct status: running
|
|
[OK] onboot: 1
|
|
mp0: local-lvm:vm-9201-disk-1,mp=/var/lib/felhom,backup=1,size=50G
|
|
mp8: /mnt/felhom-drives,mp=/mnt/felhom-drives
|
|
rootfs: local-lvm:vm-9201-disk-0,size=32G
|
|
[OK] pool: guest 9201 is a member of felhom
|
|
[OK] acl: FelhomAgentBase@/ present (user+token)
|
|
[OK] acl: FelhomAgentGuest@/pool/felhom present (user+token)
|
|
[OK] acl: FelhomAgentStore@/storage/local present (user+token)
|
|
[OK] acl: FelhomAgentStore@/storage/local-lvm present (user+token)
|
|
[OK] acl: FelhomAgentStore@/storage/felhom-pbs present (user+token)
|
|
[OK] acl: FelhomAgentGuest@/vms/990000 present (user+token)
|
|
[OK] acl: FelhomAgentGuest@/vms/990001 present (user+token)
|
|
[OK] acl: FelhomAgentGuest@/vms/990002 present (user+token)
|
|
[OK] acl: FelhomAgentGuest@/vms/990003 present (user+token)
|
|
[OK] acl: FelhomAgentGuest@/vms/990004 present (user+token)
|
|
[OK] acl: FelhomAgentGuest@/vms/990005 present (user+token)
|
|
[OK] acl: FelhomAgentGuest@/vms/990006 present (user+token)
|
|
[OK] acl: FelhomAgentGuest@/vms/990007 present (user+token)
|
|
[OK] acl: FelhomAgentGuest@/vms/990008 present (user+token)
|
|
[OK] acl: FelhomAgentGuest@/vms/990009 present (user+token)
|
|
[OK] authz signers: 2 (operator-signed self-update armed)
|
|
[OK] controller: Up 26 seconds (healthy) (after ~0s)
|
|
[INFO] controller image: gitea.dooplex.hu/admin/felhom-controller:0.350.0
|
|
[WARN] cloudflared not visible yet
|
|
[INFO] (confirm in the hub UI that host Tester4-e286d3 reports guest 9201)
|
|
|
|
[OK] Day-0 provision SUCCESS — vmid=9201 host_id=Tester4-e286d3 customer=Tester4 golden=local:backup/vzdump-lxc-9100-2026_11_03-10_09_43.tar.zst
|
|
[INFO] root@pam was rotated + vaulted at step 4b — retrieve at hub → host page (the old GUI password no longer works).
|
|
rc=0
|