ops(nh3-pve): AMT phones home to MeshCentral (CIRA); AMT on DHCP; LAN management now dark by design

2026-10-02 09:06:24 -07:00
parent 9bcb9417fb
commit 1a2d763de4
4 changed files with 21 additions and 5 deletions
@@ -56,7 +56,18 @@ not power back on by itself.
  vmbr0 members, so either cage works. **Never drop either port from the bridge**
  without checking which one has carrier (`ip -br link`). The bridge carries the
  I226-V's MAC `…:96:0d` because it is the first port listed.
- **AMT: `https://10.100.250.61:16993`** (`nh3-pve-amt.nh3.internal`; Homepage
+- ⭐ **AMT PHONES HOME since 2026-10-02 0859 (Prime): use MeshCentral, not the LAN address.** The AMT holds a
+  CIRA tunnel to `rmm-mesh.phasefinal.com:4433` (TacticalRMM's MeshCentral, group `PFI-AMT`, device
+  `nh3-pve-amt`), which does not depend on nh3-pve or nh3-scale. MeshCentral logs in over the tunnel
+  (AMT 16.1.25, power state read). Set up with `scripts/amt-cira-setup.py`; see
+  `servers/pfi-tacticalrmm/README.md`.
+  - ⚠ **The AMT is on DHCP now** (UDM reservation keeps `10.100.250.61`). Intel: CIRA does not work on a static IP.
+  - ⚠ **LAN management is OFF while it is phoning home.** Once AMT decides it is "outside" (random
+    environment-detection domain `21cade3bec8c`), `10.100.250.61:16993` stops answering, so
+    `scripts/amt-wsman.py` from nh3-dev no longer reaches it. Manage it through MeshCentral; last resort
+    is MEBx (Ctrl+P) through the NanoKVM. To go back to static, Put `amt-ethernet-static-revert.xml`
+    (this dir) on `AMT_EthernetPortSettings` through MeshCentral or from MEBx.
+- **AMT (LAN, before 2026-10-02): `https://10.100.250.61:16993`** (`nh3-pve-amt.nh3.internal`; Homepage
  card *NH3-PVE-AMT* under Infra - NH3). Intel AMT 16.1.25, **Admin Control
  Mode**. User `admin`; the password is in the vault as `nh3-pve/amt-admin`.
  - **Static IP since 2026-09-25 2306:** `10.100.250.61/24`, gateway and DNS