From 017f8f9b7655114a30f2dd9982ac2db98efd5731 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Tue, 21 Apr 2026 16:51:50 -0700 Subject: [PATCH] fleet: re-frame SureFire hosts from tenant-only to PFI-managed MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Initial framing was wrong. PFI runs these under a managed-hosting agreement: SSH, OS ops, backups are all PFI's responsibility. Hardware and data belong to the client. Changes: - ssh-target files added for sfsrv-ana (root@10.250.250.115 — same pattern as other PVE nodes) and sf-ana-container (lkraven@10.250.150.100 guess, adjust if different user). - sf-r630 still lacks an ssh-target — the OS-side LAN IP isn't in FortiGate DHCP (static config somewhere). Will fill in once identified; README flags that gap. - READMEs rewritten: dropped "tenant-scoped" / "not SSH-managed" language, added "client context" section that explains the managed-hosting relationship. Backup coverage now listed as planned rather than blocked on tenant coordination. - CLAUDE.md fleet table: SF rows re-labeled "SureFire client (PFI-managed)". Placement-rules section updated to note that SF hosts are first-class PFI-ops targets, just client-owned. - Memory (project_surefire_tenant.md) rewritten to reflect managed-services reality + hosts-file entries needed for name resolution since these aren't in PFI DNS. --- CLAUDE.md | 8 ++--- servers/sf-ana-container/README.md | 37 +++++++++++++------- servers/sf-ana-container/ssh-target | 1 + servers/sf-r630/README.md | 43 ++++++++++++++--------- servers/sfsrv-ana/README.md | 53 +++++++++++++++-------------- servers/sfsrv-ana/ssh-target | 1 + 6 files changed, 84 insertions(+), 59 deletions(-) create mode 100644 servers/sf-ana-container/ssh-target create mode 100644 servers/sfsrv-ana/ssh-target diff --git a/CLAUDE.md b/CLAUDE.md index 3b6e1d3..ab6777b 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -62,9 +62,9 @@ Observed and standardized across servers: | pfi-postgres | 10.250.50.80 | Anaheim | VM on pfi-pve (VMID 105) — shared Postgres (vaultwarden/gitea/paperless) | `servers/pfi-postgres/README.md` | | ana-wg | 10.250.50.252 | Anaheim | LXC on pfi-pve (CT 113) — WireGuard | `servers/ana-wg/README.md` | | pfi-pve | 10.250.250.31 | Anaheim | Proxmox VE hypervisor | `servers/pfi-pve/README.md` | -| sfsrv-ana | 10.250.250.115 | Anaheim | **Tenant (SureFire)** — Proxmox VE hypervisor | `servers/sfsrv-ana/README.md` | -| sf-ana-container | 10.250.150.100 | Anaheim | **Tenant (SureFire)** — container workload on sfsrv-ana | `servers/sf-ana-container/README.md` | -| sf-r630 | iDRAC 10.250.250.110 | Anaheim | **Tenant (SureFire)** — physical Dell R630, iDRAC-managed from PFI side | `servers/sf-r630/README.md` | +| sfsrv-ana | 10.250.250.115 | Anaheim | **SureFire client (PFI-managed)** — Proxmox VE hypervisor | `servers/sfsrv-ana/README.md` | +| sf-ana-container | 10.250.150.100 | Anaheim | **SureFire client (PFI-managed)** — container workload on sfsrv-ana | `servers/sf-ana-container/README.md` | +| sf-r630 | iDRAC 10.250.250.110 | Anaheim | **SureFire client (PFI-managed)** — physical Dell R630, iDRAC-managed from PFI side | `servers/sf-r630/README.md` | | nh3-docker | 10.100.50.40 | NH3 (`10.100.0.0/16`) | General-purpose Docker host (non-GPU VM on nh3-pve) | `servers/nh3-docker/README.md` | | nh3-pve | 10.100.250.60 | NH3 | Proxmox VE hypervisor | `servers/nh3-pve/README.md` | | esh-docker-vm | 10.0.50.45 | ESH home lab (`esteban.net`, `10.0.50.0/24`) | Home-lab Docker host (VM on esh-pve) | `servers/esh-docker-vm/README.md` | @@ -78,7 +78,7 @@ Observed and standardized across servers: - NH-site non-GPU services → `nh3-docker`. - ESH home-lab workloads (`esteban.net`) → `esh-docker-vm` (general) or `vm-esh-nas` (needs direct NFS mounts from 10.0.50.50). Not part of the PFI colo topology, but shares monitoring/backup tooling. - Cross-site services (e.g. Beszel hub, Dozzle hub) live on `ana-docker` and pull from agents on the other hosts. -- **SureFire (SF) tenant hosts** (`sf-*`, `sfsrv-ana`) are at the Anaheim colo but PFI doesn't control the OS. Inventory only — coordinate any management with the tenant. +- **SureFire (SF) client hosts** (`sf-*`, `sfsrv-ana`) are PFI-managed under the hosting agreement — SSH, OS ops, backups are PFI's responsibility. Hardware and data belong to the client; coordinate anything that affects data with them. - **Hypervisors** (`pfi-pve`, `nh3-pve`, `esh-pve`, `esh-pve-nas`) are tracked for inventory / capacity planning. Don't deploy Docker stacks directly on them; new workloads land as VMs. `server_inspect.sh` captures host-level detail only — VM/LXC/ZFS enumeration needs Proxmox-native tooling (`qm list`, `pvesh get …`, `zpool list`). ## How to refresh a server's state diff --git a/servers/sf-ana-container/README.md b/servers/sf-ana-container/README.md index 53bf0ae..f106f13 100644 --- a/servers/sf-ana-container/README.md +++ b/servers/sf-ana-container/README.md @@ -1,35 +1,46 @@ # sf-ana-container -**SureFire tenant workload** at the Anaheim colo — a container -host/VM running on the SureFire Proxmox (`sfsrv-ana`, 10.250.250.115). +SureFire-client container workload running on `sfsrv-ana` (SureFire's +Proxmox at 10.250.250.115). **PFI-managed** under the hosting +agreement. -## Tenancy +## Client context -- **Owner:** SureFire (tenant) -- **PFI role:** hosting provider -- **Management scope:** coordinate with SureFire before any action +- **Client:** SureFire +- **PFI role:** full-service managed host ## Network - **LAN IP:** 10.250.150.100 -- **SSH:** not wired — tenant equipment. +- **FQDN:** not in DNS yet — add to workstation `/etc/hosts`: + ``` + 10.250.150.100 sf-ana-container + ``` +- **SSH:** `lkraven@10.250.150.100` (guess — adjust if a different + user owns the container's ssh config) ## Infrastructure - **Hypervisor:** `sfsrv-ana` (SureFire Proxmox, 10.250.250.115) - **Site:** Anaheim (PFI colo) -- **Subnet:** `10.250.150.0/24` — dedicated SureFire container subnet +- **Subnet:** `10.250.150.0/24` — dedicated SF container subnet ## Role -Container/workload host for SureFire. Specific services aren't -documented here (not PFI equipment). +Container/VM workload for SureFire. Specific services TBD — refresh +the server-info snapshot once SSH is verified: + +```bash +scripts/refresh-server-info.sh sf-ana-container +``` ## Backup coverage -- **Not currently backed up by the PFI fleet.** Needs coverage plan — - see `servers/sfsrv-ana/README.md` for the three approaches under - discussion. +- **VM-image via sfsrv-ana vzdump:** status unknown — depends on what + backup jobs are configured on that Proxmox. Audit via + `scripts/refresh-proxmox-info.sh sfsrv-ana`. +- **File-level restic:** not yet configured — worth adding once we + know what state the container runs (DBs, configs, app data). ## Discovered via diff --git a/servers/sf-ana-container/ssh-target b/servers/sf-ana-container/ssh-target new file mode 100644 index 0000000..da87364 --- /dev/null +++ b/servers/sf-ana-container/ssh-target @@ -0,0 +1 @@ +lkraven@10.250.150.100 diff --git a/servers/sf-r630/README.md b/servers/sf-r630/README.md index 934a750..15d7a8b 100644 --- a/servers/sf-r630/README.md +++ b/servers/sf-r630/README.md @@ -1,36 +1,45 @@ # sf-r630 -**SureFire tenant physical server** at the Anaheim colo — Dell -PowerEdge R630. Owner operates the OS; PFI provides rack + network. +SureFire-client physical server at the Anaheim colo — Dell PowerEdge +R630. **PFI-managed** under the hosting agreement (hardware + OS ops). -## Tenancy +## Client context -- **Owner:** SureFire (tenant) -- **PFI role:** hosting provider +- **Client:** SureFire +- **PFI role:** full-service managed host ## Network - **iDRAC BMC IP:** 10.250.250.110 (on the management subnet) -- **OS-side LAN IP:** unknown — not surfaced via our DHCP discovery. - May be static, on a non-DHCP interface, or assigned to a different - subnet served by SureFire's own gear. -- **iDRAC Web UI:** https://10.250.250.110/ + - Web UI: https://10.250.250.110/ +- **OS-side LAN IP:** **unknown** — not in FortiGate DHCP (static + config?). Fill this in once identified. +- **SSH:** no `ssh-target` set yet because the OS IP isn't known. Add + one (e.g. `root@` or `lkraven@`) once identified. ## Infrastructure - **Type:** Physical Dell PowerEdge R630 - **Site:** Anaheim (PFI colo) -- **Management:** iDRAC only from the PFI side (power, console, hardware - health). OS-level access is tenant-scoped. ## Backup coverage -- Not applicable from the PFI side — tenant equipment. If hosting - terms require PFI to provide backup, coordinate with SureFire on - in-VM or OS-agent approach. +- **VM-image:** N/A (bare-metal physical) +- **File-level restic:** not yet configured + - Pending OS identification + SSH access + - Follow the `configs/restic/ana-ml2/` template when setting up + (both are bare-metal hosts; similar source list + no DB hooks by + default unless SF apps run databases) + +## Refresh state + +Once the OS IP is known and an `ssh-target` is in place: +```bash +scripts/refresh-server-info.sh sf-r630 +``` ## Discovered via -`scripts/discover-fortigate.sh 10.250.250.1` on 2026-04-21 — DHCP -lease on the management interface (MAC `74:e6:e2:fe:2c:7c`, VCI -`iDRAC`). +`scripts/discover-fortigate.sh 10.250.250.1` on 2026-04-21 — iDRAC's +DHCP lease on the management interface (MAC `74:e6:e2:fe:2c:7c`, +VCI `iDRAC`). diff --git a/servers/sfsrv-ana/README.md b/servers/sfsrv-ana/README.md index aa9073a..c0fe932 100644 --- a/servers/sfsrv-ana/README.md +++ b/servers/sfsrv-ana/README.md @@ -1,49 +1,52 @@ # sfsrv-ana -**SureFire tenant Proxmox host** at the Anaheim colo. Third-party -equipment / workload — tracked here for inventory, backup coverage, -and network awareness. +SureFire-client Proxmox hypervisor at the Anaheim colo. Client-owned +equipment but **PFI-managed** under the hosting agreement — we have SSH +and are responsible for operations. -## Tenancy +## Client context -- **Owner:** SureFire (tenant) -- **PFI role:** hosting provider — provides rack, power, network -- **Management scope:** coordinate with SureFire before any action +- **Client:** SureFire (SF prefix is SF-client hosts) +- **PFI role:** full-service managed host (rack, power, network, OS + ops, backups) ## Network - **LAN IP:** 10.250.250.115 +- **FQDN:** not yet in DNS / `/etc/hosts` — add a line to the + workstation's hosts file to make short-name resolution work: + ``` + 10.250.250.115 sfsrv-ana + ``` - **Web UI:** https://10.250.250.115:8006 (Proxmox VE) -- **SSH:** not currently wired into this workspace (tenant equipment). - If PFI ever gains admin access, add `ssh-target` here. +- **SSH:** `root@10.250.250.115` (key auth — same pattern as other PVE nodes) ## Infrastructure - **Type:** Proxmox VE hypervisor (bare metal) - **Site:** Anaheim (PFI colo) -Hosts SureFire's own VMs, including: -- `sf-ana-container` (10.250.150.100) on the container subnet +Hosts SureFire's VMs, including: +- `sf-ana-container` (10.250.150.100) on the dedicated SF container subnet ## Backup coverage -- **Not currently backed up by the PFI fleet.** -- User flagged this as **needing coverage** — open plan item. Options: - 1. Coordinate tenant-side backup of SureFire VMs using their own - target. - 2. If PFI is responsible for backups of tenant workloads under the - hosting agreement, deploy restic clients to SureFire VMs writing - into a segregated repo on `rest-server-ana` (e.g. a dedicated - htpasswd user + encryption key scoped to SureFire). - 3. File-level Proxmox vzdump into shared NAS storage, same pattern - as pfi-pve. -- Decision pending. +- **VM-image:** status unknown — probe with + `scripts/refresh-proxmox-info.sh sfsrv-ana` once SSH is verified. + If no vzdump jobs are configured, set them up the same as pfi-pve + (daily 01:00 into a network target). +- **File-level restic:** not yet configured. + +This is on the open work list — once we've validated SSH + refreshed +the Proxmox snapshot, add a `configs/restic/sfsrv-ana/` profile if +it's running hosted workloads whose state we care about beyond the +VM-image layer. ## Refresh state -Not wired into `refresh-proxmox-info.sh` — would require SSH access as -root (same flow as pfi-pve / nh3-pve / etc.). Add an `ssh-target` when -ready. +```bash +scripts/refresh-proxmox-info.sh sfsrv-ana +``` ## Discovered via diff --git a/servers/sfsrv-ana/ssh-target b/servers/sfsrv-ana/ssh-target new file mode 100644 index 0000000..39fda10 --- /dev/null +++ b/servers/sfsrv-ana/ssh-target @@ -0,0 +1 @@ +root@10.250.250.115