admin
dd961a66bb
Supervised clean-slate reinstall of the demo N100 from a pipeline-built Felhom ISO + onboarding rehearsal. Core objectives GREEN: first-boot chain reached rc-0 on the first attempt on real hardware (closes slice A's operator-gated boundary), serial-filter safety proven on metal, PBS-DR reconciler self-healed on the reused peer, DMI verdict -> key on MAC+UUID. Hard obstacle was firmware not the pipeline: this cheap AMI AN3PLUS 0.01 board won't UEFI-boot the ISO's GRUB from USB (relocation 0x0; SB-off + shim-bypass don't help), worked around live with a grub-mkimage loader from the box's own GRUB (slice-B input). 7 findings logged (F1 firmware loader HIGH; F2/F3/F4 reused-customer edges -> R-1/Peti; F5 guest-RAM, F6 drive-init mount, F7 back-route). Full doc in documentation/tests/; ROADMAP R-21 + REPORT + CONTEXT updated. No production code changed.
2.9 KiB
felhom.eu — task reports
Overwrite this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in hub/CHANGELOG.md; the scripts history lives in scripts/CHANGELOG.md.
R-21 physical run — N100 bare-metal reinstall + onboarding rehearsal — 2026-07-16
Supervised run (Viktor at the box, CC on Phase-0 prep + the SSH-side legs). Full detail:
documentation/tests/VALIDATION-n100-baremetal-2026-07-16.md. No production code changed.
Core objectives — GREEN. The demo N100 (felhom-pve, serving demo-felhom.eu) was reinstalled
clean-slate from a pipeline-built ISO (felhom-pve-9.2-1-v1.16.0-n100-demo.iso, profile filter
ID_SERIAL_SHORT=QDF922W009654S30EX, appliance). The first-boot chain reached rc-0 on the first
attempt (NRestarts=0) on real hardware — enrolled demo-felhom, provisioned guest 9201, agent
0.88.0, WG up, bootstrap.env shredded. This closes slice A's operator-gated rc-0 boundary on
metal. Serial-filter safety proven on real hardware (external-HDD canary byte-identical). PBS-DR
reconciler self-healed on the reused peer (all four steps done incl. escrow). DMI verdict on real
cheap hardware: all "Default string" → slice-C keys on MAC + UUID.
The obstacle was firmware, not the pipeline. This board's early AMI AN3PLUS 0.01 UEFI cannot
boot the ISO's GRUB from USB (relocation 0x0 is not implemented yet); Secure-Boot-off and
shim-bypass did not help (it's GRUB, not shim). The identical ISO boots in reference UEFI, and the
box's installed GRUB boots fine from the SSD — so it's the firmware relocating the ISO's USB-loaded
GRUB. Worked around live by rebuilding the stick's BOOTX64.EFI with grub-mkimage from the box's
own working 2.12-9+pmx2 GRUB (all needed modules embedded, config that searches+boots the ISO). This
is the top slice-B input: the pipeline should ship a firmware-compatible loader and/or a PXE path.
Findings to tackle (7): F1 firmware boot loader (HIGH, slice-B); F2 no claim-code re-issue on
reinstall (+ verify open-vs-gated); F3 offsite creds need re-issue on reprovision; F4 PBS-DR 403 —
install ACL grants only default felhom-pbs, not the config's felhom-offsite storage id; F5 guest
RAM 2 GB not configurable; F6 drive-initialize formats but doesn't mount+attach (client-disconnect
aborts post-mkfs, no UI feedback); F7 storage Back-route → /settings. F2/F3/F4 are reused-customer
clean-slate edges feeding R-1/Peti. BookStack deployed + works.
Current state: box healthy, demo-felhom.eu live, guest 9201 running (controller/traefik/cloudflared/
filebrowser/bookstack), external HDD reformatted + attached as hdd_1. Onboarding not finished (claim
- escrow pending on F2/F3/F4). Boot stick (secret-bearing, with the GRUB workaround) to be wiped at teardown. Findings will be worked next per Viktor.