felhom.eu/documentation/audits/release-2026-10-26/byo/install-console.txt

[INFO] felhom-host-install v1.36.0 — mode=byo customer=Tester4 vmid=9201

[STEP] 1/8 pre-flight
[INFO]   pve-manager/9.2.2/b9984c6d90a4bd80 (running kernel: 7.0.2-6-pve)
[INFO]   node: byo-test (explicit)
[INFO]   agent config: /etc/felhom-agent/agent.json
[INFO]   agent: not installed yet — will be fetched + installed in step 5/8
[INFO]   local-lvm free: ~29 GiB
[WARN] local-lvm free ~29 GiB is below the recommended 120 GiB — the install continues; proceed only if you sized the grows deliberately
[INFO]   free RAM: ~6285 MiB
[INFO]   existing guests on this host: 0 (pct+qm)
[INFO]   archive storage 'local' present
[INFO]   acl storages all present or pre-positioned: local local-lvm
[INFO]   dnsmasq: not present before Felhom — recorded; uninstall will remove it again if we install it
[INFO]   host DNS (:53): free
[INFO]   hub reachable (https://hub.felhom.eu)
[OK]   customer 'Tester4' exists + passphrase valid
[INFO]   golden: none local — will fetch + verify from Gitea in step 7/8
byo-test

[STEP] BYO disclosure — installing Felhom on a host the operator does NOT own will create:
    pveum:  roles FelhomAgentBase/FelhomAgentGuest/FelhomAgentStore + user felhom-agent@pve + token felhom-agent@pve!agent
            + scoped ACL grants (Base@/, Guest@/pool/felhom, Store@[local local-lvm]) + the 'felhom' pool
    agent:  service user felhom-agent + /usr/local/bin/felhom-agent (+ .bak-* backups; A/B slots via the guarded self-update)
            + /etc/systemd/system/felhom-agent.service (+ felhom-agent-rollback.service + start-limit drop-in)
            + /etc/sudoers.d/felhom-agent + state dir /var/lib/felhom-agent + config /etc/felhom-agent/agent.json (0600)
    host:   /usr/local/sbin/felhom-mkfs-guarded + /usr/local/sbin/felhom-selfupdate-guarded
            + /usr/local/sbin/felhom-pbs-apply (PBS-DR apply wrapper — DR capability is baked
              on every install; ACTIVATION stays a hub flag, off = zero effect on this host)
            + felhom-mgmt-watchdog service+timer+script + /etc/tmpfiles.d/felhom-privsep.conf
            + /usr/local/sbin/felhom-priv-apply + the guest-hook snippet under /var/lib/vz/snippets/
              (both from the agent's config bundle)
            + the 'sudo' and 'age' packages if absent + install state dir /var/lib/felhom-install
    wg:     an OUTBOUND WireGuard tunnel to the Felhom hub (wg_tunnel.enabled=true — base
            infrastructure like the cloudflared tunnel; hands-free peer registration; the
            operator can disable it per-customer hub-side on request)
    guest:  the provisioned Felhom LXC (vmid 9201, capped 2 cores / 4096 MiB) + its volumes
            + the golden vzdump imported onto storage 'local'
    reuse:  a golden already on 'local' is used only if its sha256 or its controller version
            matches the hub's vouched golden; otherwise the vouched one is fetched (a --golden you name is refused)
    update: operator-signed self-update authority: felhom-op-1
    NOT touched in byo mode: root@pam (no break-glass), host DNS (:53), OOB sshd.

Type this host's short hostname (byo-test) to acknowledge the byo install: [OK]   byo install acknowledged for host byo-test
[OK] pre-flight passed
[STEP] 2/8 Proxmox API token
[OK]   token minted (secret captured, not logged)
[OK]   scoped ACL applied (Base@/, Guest@/pool/felhom + /vms/990000..990009, Store@[local local-lvm])
[SKIP]   old broad role FelhomAgent already absent
[STEP] 3/8 compute volume grows
[INFO]   auto-computed from a 29 GiB thin pool (16 §7: 50/100/130 GiB)
[INFO]   grows: rootfs +0G (->32G), data +26G (->50G, ONE volume)
[STEP] 4/8 host enrollment (POST /host-enroll)
[OK]   host MINTED (first enroll)
[INFO]   host_id: Tester4-f967d4 (api_key captured, not logged)
[SKIP] break-glass (step 4b) SKIPPED (byo: the host owner manages break-glass; root@pam untouched, nothing vaulted)
[STEP] 5/8 agent install (fetch + verify + install)
[SKIP]   apt repo alignment skipped (byo — the owner manages repos)
[WARN]   no git credential in controller.yaml — fetching artifacts ANONYMOUSLY (they are world-readable; sha256 verification unchanged)
[INFO]   manifest: agent v0.164.0 (sha 1b803d8b70f8afbe…), golden v0.331.0
[INFO]   fetching agent binary v0.164.0 from Gitea …
[OK]   verified sha256 1b803d8b70f8afbe… matches the hub manifest
[OK]   installed /usr/local/bin/felhom-agent (felhom-agent 0.164.0)
[INFO]   installing the 'sudo' package (required for the non-root agent model) …
[OK]   sudo installed (Sudo version 1.9.16p2)
[INFO]   installing the 'age' package (escrow ceremony identity-wrap dependency) …
[OK]   age installed (1.2.1)
[OK]   created service user felhom-agent
[OK]   added felhom-agent to systemd-journal (unprivileged journal read for NAS verify)
[OK]   verified sha256 1d7b54d39d0c1aff… matches the hub manifest
  os-apply: BUNDLE START agent=0.164.0 sha=1d7b54d39d0c1aff authority=installer files=32 write=26 same=2 kept=0 skipped=4
  os-apply: BUNDLE WROTE /usr/local/sbin/felhom-mkfs-guarded (new)
  os-apply: BUNDLE WROTE /usr/local/sbin/felhom-selfupdate-guarded (new)
  os-apply: BUNDLE WROTE /usr/local/sbin/felhom-pbs-apply (new)
  os-apply: BUNDLE WROTE /usr/local/sbin/felhom-backup-target-apply (new)
  os-apply: BUNDLE WROTE /usr/local/sbin/felhom-vzdump-partial-clean (new)
  os-apply: BUNDLE WROTE /usr/local/sbin/felhom-thin-check (new)
  os-apply: BUNDLE WROTE /usr/local/sbin/felhom-internal-place (new)
  os-apply: BUNDLE WROTE /usr/local/sbin/felhom-crash-guard (new)
  os-apply: BUNDLE WROTE /usr/local/sbin/felhom-priv-apply (new)
  os-apply: BUNDLE WROTE /var/lib/vz/snippets/felhom-guest-hook.sh (new)
  os-apply: BUNDLE WROTE /usr/local/sbin/felhom-shared-parent.sh (new)
  os-apply: BUNDLE WROTE /etc/systemd/system/felhom-shared-parent.service (new)
  os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard.service (new)
  os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard-check.service (new)
  os-apply: BUNDLE WROTE /etc/systemd/system/felhom-crash-guard-check.timer (new)
  os-apply: BUNDLE WROTE /etc/felhom/crash-guard.conf (new)
  os-apply: BUNDLE WROTE /etc/grub.d/01_felhom_oneshot (new)
  os-apply: BUNDLE WROTE /etc/grub.d/42_felhom_oneshot (new)
  os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent.service (new)
  os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent-rollback.service (new)
  os-apply: BUNDLE WROTE /etc/systemd/system/felhom-agent.service.d/felhom-agent-limits.conf (new)
  os-apply: BUNDLE WROTE /usr/local/sbin/felhom-mgmt-watchdog (new)
  os-apply: BUNDLE WROTE /etc/tmpfiles.d/felhom-privsep.conf (new)
  os-apply: BUNDLE WROTE /etc/systemd/system/felhom-mgmt-watchdog.service (new)
  os-apply: BUNDLE WROTE /etc/systemd/system/felhom-mgmt-watchdog.timer (new)
  os-apply: BUNDLE WROTE /etc/sudoers.d/felhom-agent (new)
  os-apply: BUNDLE DONE agent=0.164.0 written=26 same=2 self-check=ok signers-created=False
[OK]   installed every root-owned file from config bundle v0.164.0 (sha 1d7b54d39d0c1aff…; checked, previous copies kept)
[SKIP]   OOB (felhom-sshd) off (byo, or appliance --no-oob) — the bundle skipped its files
[STEP] 5b/8 internal data place (Belső tárhely)
[SKIP]   byo: the host owner's thin pool is not ours to divide — no internal place
[STEP] 6/8 agent config + service
[WARN]   backup target: DEGRADED — no eligible second drive, so the whole-system backup stays on the SYSTEM drive.
[WARN]   It protects against file corruption but NOT against a disk failure. Attach a second drive and assign it in the dashboard.
[INFO]   node=byo-test  local_api=192.168.0.151:8443  tls_fp=7E:77:41:86:26:92…
[OK]   wrote /etc/felhom-agent/agent.json (0600 felhom-agent)
[OK]   byo config asserts passed (lan_resolver.enable / oob.enabled off; deployment_mode=byo; wg_tunnel intentionally ON — base infrastructure)
[OK]   agent --selftest (read-only) passed
[OK]   felhom-agent service active (non-root felhom-agent reads the config OK)
[OK]   wrote /etc/felhom/os-trust.json + operator-signers (felhom-op-1) — the root-owned slow-lane anchors
[STEP] 7/8 golden archive
[WARN]   no git credential in controller.yaml — fetching artifacts ANONYMOUSLY (they are world-readable; sha256 verification unchanged)
[INFO]   fetching golden v0.331.0 from Gitea → /var/lib/vz/dump/vzdump-lxc-9100-2026_10_25-17_52_14.tar.zst
[OK]   verified sha256 3881de62b0986ccb… matches the hub manifest
[OK]   golden imported + verified: local:backup/vzdump-lxc-9100-2026_10_25-17_52_14.tar.zst
[STEP] 8/8 provision guest 9201
[SKIP]   pool felhom already exists
=== felhom-agent 0.164.0 selftest=provision (vmid=9201 customer=Tester4 hostname=tester4) ===
  --- front half: bring-up (provision) local:backup/vzdump-lxc-9100-2026_10_25-17_52_14.tar.zst → vmid 9201 ---
time=2026-10-25T17:53:51.729+01:00 level=INFO msg="bring-up: pool membership re-asserted" vmid=9201 pool=felhom
  [OK] front half: vmid 9201 up (boot+running) in 1m26s; MAC=BC:24:11:4B:04:4E
  --- back half: mint per-guest token + populate bootstrap config mount ---
time=2026-10-25T17:53:56.751+01:00 level=INFO msg="provision: back-half complete" vmid=9201 mount=mp9 guest_path=/etc/felhom-bootstrap endpoint=192.168.0.151:8443
  [OK] back half: bootstrap mount mp9 → /etc/felhom-bootstrap on vmid 9201 (host dir /var/lib/felhom-agent/guests/9201/bootstrap)
  local-api endpoint 192.168.0.151:8443 · leaf fp f09a20d4c01686516db562b6acc9aa7e95581d69c2318fccf7894ed772ef4a8e · token: minted (not printed)
=== selftest=provision OK — guest 9201 provisioned + bootstrap-mounted (KEPT) ===
    next: reboot the guest → the golden's baked controller-bootstrap unit deploys the controller,
    which PULLS its controller.yaml from the hub (retrieval passphrase) and merges in this local_api.
[OK]   provision completed
[INFO]   rebooting guest 9201 so the baked controller-bootstrap unit picks up the mount
[STEP] verify
[OK]   pct status: running
[OK]   onboot: 1
    mp0: local-lvm:vm-9201-disk-1,mp=/var/lib/felhom,backup=1,size=50G
    mp8: /mnt/felhom-drives,mp=/mnt/felhom-drives
    rootfs: local-lvm:vm-9201-disk-0,size=32G
[OK]   pool: guest 9201 is a member of felhom
[OK]   acl: FelhomAgentBase@/ present (user+token)
[OK]   acl: FelhomAgentGuest@/pool/felhom present (user+token)
[OK]   acl: FelhomAgentStore@/storage/local present (user+token)
[OK]   acl: FelhomAgentStore@/storage/local-lvm present (user+token)
[OK]   acl: FelhomAgentGuest@/vms/990000 present (user+token)
[OK]   acl: FelhomAgentGuest@/vms/990001 present (user+token)
[OK]   acl: FelhomAgentGuest@/vms/990002 present (user+token)
[OK]   acl: FelhomAgentGuest@/vms/990003 present (user+token)
[OK]   acl: FelhomAgentGuest@/vms/990004 present (user+token)
[OK]   acl: FelhomAgentGuest@/vms/990005 present (user+token)
[OK]   acl: FelhomAgentGuest@/vms/990006 present (user+token)
[OK]   acl: FelhomAgentGuest@/vms/990007 present (user+token)
[OK]   acl: FelhomAgentGuest@/vms/990008 present (user+token)
[OK]   acl: FelhomAgentGuest@/vms/990009 present (user+token)
[OK]   authz signers: 2 (operator-signed self-update armed)
[OK]   controller: Up 5 seconds (healthy) (after ~0s)
[INFO]   controller image: gitea.dooplex.hu/admin/felhom-controller:0.342.0
[WARN]   cloudflared not visible yet
[INFO]   (confirm in the hub UI that host Tester4-f967d4 reports guest 9201)

[OK] Day-0 provision SUCCESS — vmid=9201 host_id=Tester4-f967d4 customer=Tester4 golden=local:backup/vzdump-lxc-9100-2026_10_25-17_52_14.tar.zst
INSTALL_RC=0
Connection to 192.168.0.151 closed.