felhom.eu/documentation/audits/release-2026-11-03/part2/uninstall-first-run.txt

[INFO] felhom-host-install v1.36.1 — mode=uninstall

[STEP] UNINSTALL — local host teardown
[INFO]   vmid 9201 looks like a Felhom guest (has the /etc/felhom-bootstrap mount)
[INFO]   pct config 9201:
    arch: amd64
    cores: 5
    features: nesting=1,keyctl=1
    hookscript: local:snippets/felhom-guest-hook.sh
    hostname: tester4
    memory: 5847
    mp0: local-lvm:vm-9201-disk-1,mp=/var/lib/felhom,backup=1,size=50G
    mp8: /mnt/felhom-drives,mp=/mnt/felhom-drives
    mp9: /var/lib/felhom-agent/guests/9201/bootstrap,mp=/etc/felhom-bootstrap,ro=1
    net0: name=eth0,bridge=vmbr0,hwaddr=BC:24:11:B5:1C:21,ip=dhcp,type=veth
    net1: name=eth1,bridge=vmbr9,hwaddr=BC:24:11:F5:D8:D1,ip=169.254.253.2/30,type=veth
    onboot: 1
    ostype: debian
    rootfs: local-lvm:vm-9201-disk-0,size=32G
    swap: 5847
    unprivileged: 1
Type the vmid (9201) to confirm PERMANENT destruction: 9201
  Logical volume "vm-9201-disk-0" successfully removed.
  Logical volume "vm-9201-disk-1" successfully removed.
[OK]   guest 9201 destroyed
[STEP] host-level removal
Removed '/etc/systemd/system/multi-user.target.wants/felhom-agent.service'.
[OK]   removed /etc/felhom-agent (the agent config and every copy of it)
Removed '/etc/systemd/system/multi-user.target.wants/wg-quick@wg-felhom.service'.
[OK]   WireGuard tunnel to the Felhom off-site endpoint is down (wg-quick@wg-felhom disabled, conf removed)
Removed '/etc/systemd/system/timers.target.wants/felhom-mgmt-watchdog.timer'.
Removed '/etc/systemd/system/multi-user.target.wants/felhom-sshd.service'.
Removed '/etc/systemd/system/multi-user.target.wants/felhom-oob-nft.service'.
The unit files have no installation config (WantedBy=, RequiredBy=, UpheldBy=,
Also=, or Alias= settings in the [Install] section, and DefaultInstance= for
template units). This means they are not meant to be enabled or disabled using systemctl.
 
Possible reasons for having these kinds of units are:
• A unit may be statically enabled by being symlinked from another unit's
  .wants/, .requires/, or .upholds/ directory.
• A unit's purpose may be to act as a helper for some other unit which has
  a requirement dependency on it.
• A unit may be started when needed via activation (socket, path, timer,
  D-Bus, udev, scripted systemctl call, ...).
• In case of template units, the unit is meant to be enabled with some
  instance name specified.
Removed '/etc/systemd/system/pve-guests.service.wants/felhom-shared-parent.service'.
Removed '/etc/systemd/system/multi-user.target.wants/felhom-shared-parent.service'.
Generating grub configuration file ...
Found linux image: /boot/vmlinuz-7.0.2-6-pve
Found initrd image: /boot/initrd.img-7.0.2-6-pve
Found memtest86+ 64bit EFI image: /boot/memtest86+x64.efi
Found memtest86+ 32bit EFI image: /boot/memtest86+ia32.efi
Found memtest86+ 64bit image: /boot/memtest86+x64.bin
Found memtest86+ 32bit image: /boot/memtest86+ia32.bin
Adding boot menu entry for UEFI Firmware Settings ...
done
[INFO]   dnsmasq was installed by Felhom (recorded at install) — stopping + disabling it
Synchronizing state of dnsmasq.service with SysV service script with /usr/lib/systemd/systemd-sysv-install.
Executing: /usr/lib/systemd/systemd-sysv-install disable dnsmasq
Removed '/etc/systemd/system/multi-user.target.wants/dnsmasq.service'.
[INFO]   dnsmasq: removing the package(s) Felhom installed: dnsmasq dnsmasq-base
Reading package lists... 0%Reading package lists... 100%Reading package lists... Done
Building dependency tree... 0%Building dependency tree... 0%Building dependency tree... 50%Building dependency tree... 50%Building dependency tree... Done
Reading state information... 0% Reading state information... 48%Reading state information... Done
The following packages will be REMOVED:
  dnsmasq* dnsmasq-base*
0 upgraded, 0 newly installed, 2 to remove and 194 not upgraded.
After this operation, 1,303 kB disk space will be freed.
(Reading database ... (Reading database ... 5%(Reading database ... 10%(Reading database ... 15%(Reading database ... 20%(Reading database ... 25%(Reading database ... 30%(Reading database ... 35%(Reading database ... 40%(Reading database ... 45%(Reading database ... 50%(Reading database ... 55%(Reading database ... 60%(Reading database ... 65%(Reading database ... 70%(Reading database ... 75%(Reading database ... 80%(Reading database ... 85%(Reading database ... 90%(Reading database ... 95%(Reading database ... 100%(Reading database ... 52606 files and directories currently installed.)
Removing dnsmasq (2.91-1+deb13u2) ...
Removing dnsmasq-base (2.91-1+deb13u2) ...
Processing triggers for dbus (1.16.2-2) ...
Processing triggers for man-db (2.13.1-1) ...
(Reading database ... (Reading database ... 5%(Reading database ... 10%(Reading database ... 15%(Reading database ... 20%(Reading database ... 25%(Reading database ... 30%(Reading database ... 35%(Reading database ... 40%(Reading database ... 45%(Reading database ... 50%(Reading database ... 55%(Reading database ... 60%(Reading database ... 65%(Reading database ... 70%(Reading database ... 75%(Reading database ... 80%(Reading database ... 85%(Reading database ... 90%(Reading database ... 95%(Reading database ... 100%(Reading database ... 52554 files and directories currently installed.)
Purging configuration files for dnsmasq-base (2.91-1+deb13u2) ...
Purging configuration files for dnsmasq (2.91-1+deb13u2) ...
[OK]   dnsmasq removed — the next install starts from a clean slate, as a first install
[SKIP]   old broad role FelhomAgent already absent
Removed volume 'local:backup/vzdump-lxc-9100-2026_11_03-08_32_37.tar.zst'
[OK]   removed golden vzdump(s) from local

[STEP] kept vs wiped — read before pulling drives or closing the customer out
  WIPED (this run):
    - guest 9201 (container + its OS/Docker/user-data volumes)
    - the felhom-agent: binary, unit, sudoers (+ its copies), state dir, service user, and its config
      directory with every copy of the config in it
    - the WireGuard tunnel to the Felhom off-site endpoint (wg-quick@wg-felhom disabled, /etc/wireguard/wg-felhom.conf removed)
    - self-update artifacts: guarded wrapper, A/B slots (.prev/.new.*), rollback unit, start-limit drop-in
    - break-glass watchdog + OOB artifacts (where present); guest-hook snippet; dnsmasq snippets; the mkfs, pbs-apply,
      backup-target-apply, os-apply and priv-apply wrappers; the crash guard; the config-bundle record
    - pveum: the Felhom roles/user/token/scoped ACL; the emptied felhom pool
    - the install state file
    - the golden vzdump (--remove-golden)
  KEPT (lives on deliberately — remove/rotate these out-of-band if the customer is leaving):
    - the enrolled drives + ALL data under /mnt/felhom-drives — unmounted only, NEVER wiped;
      the drives are physically removable now.
    - the hub host/customer record + report history (operator UI / DB)
    - this host's WireGuard PEER on the hub and the off-site endpoint (its /32 and public key) — the
      tunnel is down from this side; delete the peer in the hub (operator) if the customer is leaving
    - the vmbr9 island bridge stanza in /etc/network/interfaces (host-internal, no port; a reinstall
      reuses it) — to remove it: delete the stanza, then ifreload -a
    - the appliance ISO's first-boot files: /etc/felhom/.bootstrap-done, /etc/felhom/appliance-pairing-code,
      felhom-bootstrap.service (disabled, fired once) — not this script's; remove by hand if wanted
    - the escrow blob in the hub, if one exists (operator UI)
    - the hub-vaulted root@pam recovery credential — the box KEEPS the password step 4b set; rotate it if the box leaves Felhom management

[OK] UNINSTALL complete — removed: guest 9201, the felhom-agent (unit/sudoers/binary/state/config+baks/user + selfupdate-artifacts/shared-parent/mkfs-wrapper/pbs-apply-wrapper/hook-snippet/dnsmasq-snippets), the pveum role/user/token/ACL, the felhom pool, and /var/lib/felhom-install/state.json.
[INFO]   golden vzdump: removed.
[INFO]   NOTE: the 'sudo' package was left INSTALLED (a system package, never ours to remove). dnsmasq is removed only when the install-time record says Felhom installed it; a resolver that pre-dated Felhom is never touched. The host record still exists in the hub — remove it there if desired.