fix(pve-nvidia-host): refuse early on Secure Boot without an enrolled DKMS key; record nh3-pve SB=on

playbooks/pve-nvidia-host.yaml

@@ -33,6 +33,13 @@
 # module holds nothing and unloads cleanly. The unload step refuses if nouveau
 # has actually bound a device; then the blacklist plus a reboot is the only way.
 #
+# ⚠ SECURE BOOT: a DKMS-built module only loads under Secure Boot if its signing
+# key is enrolled as a MOK, and enrolling needs a person at the console at boot
+# (MokManager). esh-pve has Secure Boot OFF. nh3-pve has it ON (lockdown =
+# integrity), and the 2026-09-25 install failed there with "module failed to load".
+# The installer rolled itself back. The first step below now refuses early
+# instead of getting that far.
+#
 # Upgrading the driver: bump driver_version + driver_sha256 here AND
 # driver_version in playbooks/gpu-lxc.yaml, run this on every GPU host, then
 # gpu-lxc.yaml for every GPU LXC. Until both have run, CUDA in the container
@@ -50,6 +57,18 @@ vars:
   gpu_match: RTX 2000
 
 steps:
+  - name: Pre-flight — Secure Boot off, or the DKMS signing key already enrolled
+    shell: |
+      if mokutil --sb-state 2>/dev/null | grep -q 'SecureBoot enabled'; then
+        if [ -f /var/lib/dkms/mok.pub ] && mokutil --test-key /var/lib/dkms/mok.pub 2>&1 | grep -q 'already enrolled'; then
+          exit 0
+        fi
+        echo "Secure Boot is ON and no enrolled DKMS key: the nvidia module would be refused." >&2
+        echo "Needs the console at boot: disable Secure Boot in the BIOS, or enroll /var/lib/dkms/mok.pub via MokManager." >&2
+        exit 1
+      fi
+    changed_when: "false"
+
   # DKMS needs the headers for the RUNNING kernel (built now) and the series
   # meta-package (so each future kernel's headers arrive with it and DKMS
   # rebuilds on upgrade). nh3-pve had neither, nor dkms or a compiler.