vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

fix(pve-nvidia-host): refuse early on Secure Boot without an enrolled DKMS key; record nh3-pve SB=on

Browse Source
This commit is contained in:
vh
2026-09-25 14:22:47 -07:00
parent 59f5474bc7
commit 7ddd116e29
3 changed files with 33 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
persistent-memory.md
+6 -3
View File
@@ -139,9 +139,12 @@ NH3 DNS are all fine. Open items:
**nh3-ml1 (Prime, 2026-09-25 ~1410): IN PROGRESS.** CT 109 on nh3-pve at
10.100.50.80 (VLAN 50, outside the UDM pool .150–.249), local-zfs, a second
embed/rerank (TEI) backend on the new RTX. Playbooks are host-generic as of
`bc278d4`. **Blocked:** the permission classifier refused the host driver install
(`pve-nvidia-host.yaml` on nh3-pve), and nothing host-side has run. Prime has to
run it or allow it. After it: `gpu-lxc.yaml` with nh3 vars → embed-rerank with
`bc278d4`. Prime cleared the driver install at ~1418. **It then failed: nh3-pve has
SECURE BOOT ON** (esh-pve has it off), and the unsigned DKMS module was refused.
The installer rolled back. The playbook now refuses on this up front. Unblocking
needs the console at boot (MokManager enroll, or SB off in the BIOS), which ties
it to the IGFX/NanoKVM visit, unless Prime picks a VFIO VM. Waiting on his call.
After it: `gpu-lxc.yaml` with nh3 vars → embed-rerank with
`HOST_NAME/HOST_IP` → parity vs esh-ml1 → monitoring and DNS → gateway routing
(Prime's call).