vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

servers: register nh3-extdev (sudo-less infra-ops manager box)

Browse Source 
NH3 manager/external-dev box at 10.100.50.42 (Debian 13 VM on nh3-pve),
successor to the retired nh3-ansible. infra-ops identity here is sudo-LESS
by operator decision (2026-06-17): key-only, no NOPASSWD, not in docker
group — user-level management only. Adds servers/nh3-extdev/{README,
ssh-target,system-details.txt}, the CLAUDE.md inventory row, and a local
ssh alias (nh3-extdev -> infra-ops@10.100.50.42, infra-ops key). Login +
sudo-less posture verified.
This commit is contained in:
vh
2026-06-17 14:57:06 -07:00
parent fe77a3596a
commit a841eab3ff
4 changed files with 110 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
servers/nh3-extdev/README.md
+34
View File
@@ -0,0 +1,34 @@
# nh3-extdev
NH3-site **manager / external-dev box** — `10.100.50.42`. Fresh Debian 13
(trixie) VM on `nh3-pve` (QEMU: 8 vCPU / 7.8 GB / 250 GB, no GPU). Successor to
the retired **nh3-ansible**. Not a Docker-stack host (Docker not installed).
**Reach:** the dedicated agent identity only —
`ssh nh3-extdev` (alias) = `ssh -i ~/.ssh/infra-ops_ed25519 infra-ops@10.100.50.42`.
The `infra-ops` user here is **sudo-LESS by design** (operator decision
2026-06-17): key-only login, password locked, **no NOPASSWD sudo**, **not** in the
`docker` group — deliberately tighter than the rest of the fleet's infra-ops
identity ([`reference_infra_ops_sudo_identity`] in auto-memory, which is the
*sudo* variant). Management here is **user-level only**: files/repos/tooling under
the home dir, `systemctl --user`, world-readable system state. No root ops (apt,
system services, `/etc`, root-owned files) and **no Docker** unless a later,
explicit grant is made (command-scoped sudoers preferred over docker-group, which
is root-equivalent).
## Purpose
NH3 manager / external-dev box; role being established (2026-06-17). Successor to
the retired `nh3-ansible`.
<!-- Refine once the workload is settled — e.g. if this becomes the pi/GLM
client-agent control node, document the per-client workspace layout here. -->
## Notes
- Debian **13** (trixie) — newer than the fleet's Debian-12 baseline; watch for
package/behaviour drift vs other hosts.
- `sudo` warns `unable to resolve host nh3-extdev` (hostname not in `/etc/hosts`)
— cosmetic; add `127.0.1.1 nh3-extdev` to `/etc/hosts` (needs root) to silence.
- Stood up 2026-06-17; first `system-details.txt` captured the same day (sudo-less,
so docker/root-only sections are necessarily blank).