admin
dd961a66bb
Supervised clean-slate reinstall of the demo N100 from a pipeline-built Felhom ISO + onboarding rehearsal. Core objectives GREEN: first-boot chain reached rc-0 on the first attempt on real hardware (closes slice A's operator-gated boundary), serial-filter safety proven on metal, PBS-DR reconciler self-healed on the reused peer, DMI verdict -> key on MAC+UUID. Hard obstacle was firmware not the pipeline: this cheap AMI AN3PLUS 0.01 board won't UEFI-boot the ISO's GRUB from USB (relocation 0x0; SB-off + shim-bypass don't help), worked around live with a grub-mkimage loader from the box's own GRUB (slice-B input). 7 findings logged (F1 firmware loader HIGH; F2/F3/F4 reused-customer edges -> R-1/Peti; F5 guest-RAM, F6 drive-init mount, F7 back-route). Full doc in documentation/tests/; ROADMAP R-21 + REPORT + CONTEXT updated. No production code changed.
38 lines
2.9 KiB
Markdown
38 lines
2.9 KiB
Markdown
# felhom.eu — task reports
|
|
|
|
> **Overwrite** this file with a summary of the most recent task only (uniform with the other repos; not cumulative). The cumulative hub history lives in [hub/CHANGELOG.md](hub/CHANGELOG.md); the scripts history lives in [scripts/CHANGELOG.md](scripts/CHANGELOG.md).
|
|
|
|
## R-21 physical run — N100 bare-metal reinstall + onboarding rehearsal — 2026-07-16
|
|
|
|
Supervised run (Viktor at the box, CC on Phase-0 prep + the SSH-side legs). Full detail:
|
|
**`documentation/tests/VALIDATION-n100-baremetal-2026-07-16.md`**. No production code changed.
|
|
|
|
**Core objectives — GREEN.** The demo N100 (felhom-pve, serving demo-felhom.eu) was reinstalled
|
|
clean-slate from a pipeline-built ISO (`felhom-pve-9.2-1-v1.16.0-n100-demo.iso`, profile filter
|
|
`ID_SERIAL_SHORT=QDF922W009654S30EX`, appliance). The first-boot chain reached **rc-0 on the first
|
|
attempt (`NRestarts=0`)** on real hardware — enrolled `demo-felhom`, provisioned guest 9201, agent
|
|
0.88.0, WG up, `bootstrap.env` shredded. This **closes slice A's operator-gated rc-0 boundary on
|
|
metal.** Serial-filter safety proven on real hardware (external-HDD canary byte-identical). PBS-DR
|
|
reconciler self-healed on the reused peer (all four steps done incl. escrow). DMI verdict on real
|
|
cheap hardware: all "Default string" → slice-C keys on **MAC + UUID**.
|
|
|
|
**The obstacle was firmware, not the pipeline.** This board's early AMI `AN3PLUS 0.01` UEFI cannot
|
|
boot the ISO's GRUB **from USB** (`relocation 0x0 is not implemented yet`); Secure-Boot-off and
|
|
shim-bypass did **not** help (it's GRUB, not shim). The identical ISO boots in reference UEFI, and the
|
|
box's installed GRUB boots fine from the SSD — so it's the firmware relocating the ISO's USB-loaded
|
|
GRUB. **Worked around live** by rebuilding the stick's `BOOTX64.EFI` with `grub-mkimage` from the box's
|
|
own working `2.12-9+pmx2` GRUB (all needed modules embedded, config that searches+boots the ISO). This
|
|
is the top **slice-B input**: the pipeline should ship a firmware-compatible loader and/or a PXE path.
|
|
|
|
**Findings to tackle (7):** F1 firmware boot loader (HIGH, slice-B); F2 no claim-code re-issue on
|
|
reinstall (+ verify open-vs-gated); F3 offsite creds need re-issue on reprovision; F4 PBS-DR 403 —
|
|
install ACL grants only default `felhom-pbs`, not the config's `felhom-offsite` storage id; F5 guest
|
|
RAM 2 GB not configurable; F6 drive-initialize formats but doesn't mount+attach (client-disconnect
|
|
aborts post-mkfs, no UI feedback); F7 storage Back-route → /settings. F2/F3/F4 are reused-customer
|
|
clean-slate edges feeding R-1/Peti. BookStack deployed + works.
|
|
|
|
**Current state:** box healthy, demo-felhom.eu live, guest 9201 running (controller/traefik/cloudflared/
|
|
filebrowser/bookstack), external HDD reformatted + attached as `hdd_1`. Onboarding not finished (claim
|
|
+ escrow pending on F2/F3/F4). Boot stick (secret-bearing, with the GRUB workaround) to be wiped at
|
|
teardown. Findings will be worked next per Viktor.
|