feat(nh3-svos): VM 111 on nh3-pve-2 for the new SVOS (svos-dev, Prime); generic cloud-init VM playbook
This commit is contained in:
@@ -362,6 +362,7 @@ Observed and standardized across servers:
|
||||
| nh3-pve | 10.100.250.60 | NH3 | Proxmox VE hypervisor | `servers/nh3-pve/README.md` |
|
||||
| nh3-pve-2 | 10.100.250.62 | NH3 | Proxmox VE hypervisor (Minisforum MS-03, standalone, not clustered); purpose TBD, first guest nh3-albok | `servers/nh3-pve-2/README.md` |
|
||||
| nh3-albok | 10.100.50.44 | NH3 | VM 110 on nh3-pve-2 — runs **only** albok-service (fleet knowledgebase); no Docker API on tcp, no socket containers, by design | `servers/nh3-albok/README.md` |
|
||||
| nh3-svos | 10.100.50.43 | NH3 | VM 111 on nh3-pve-2 — the NEW SVOS operating system (svos-dev owns the app); separate from the High Seat on nh3-dev | `servers/nh3-svos/README.md` |
|
||||
| nh3-nas | 10.100.50.50 | NH3 | Synology RS2418+ — NFS exports, rest-server-nh3, PBS-NH3 datastore backend | `servers/nh3-nas/README.md` |
|
||||
| pbs-nh3 | 10.100.50.90 | NH3 | Proxmox Backup Server — DR mirror (VM on nh3-pve, NFS datastore on nh3-nas); syncs from pbs-ana | `servers/pbs-nh3/README.md` |
|
||||
| esh-docker-vm | 10.0.50.45 | ESH home lab (`esteban.net`, `10.0.50.0/24`) | Home-lab Docker host (VM on esh-pve) | `servers/esh-docker-vm/README.md` |
|
||||
|
||||
@@ -86,6 +86,7 @@ hosts:
|
||||
- {name: nh3-pve-2-amt, site: nh3, v4: 10.100.250.63, note: Intel AMT 21 (vPro) on nh3-pve-2's (MS-03) I226-LM — UDM port 5 (native nh3-mgmt), DHCP reservation for 38:05:25:3b:a0:a6; LAN mgmt goes dark once CIRA is set up}
|
||||
- {name: pbs-nh3, site: nh3, v4: 10.100.50.90, note: Proxmox Backup Server — DR mirror}
|
||||
- {name: nh3-albok, site: nh3, v4: 10.100.50.44, note: VM 110 on nh3-pve-2 — runs ONLY albok-service (no Docker API on tcp, no socket containers)}
|
||||
- {name: nh3-svos, site: nh3, v4: 10.100.50.43, note: VM 111 on nh3-pve-2 — the NEW SVOS operating system (svos-dev); separate from the High Seat on nh3-dev}
|
||||
- {name: nh3-gw, site: nh3, v4: 10.100.0.1, note: UniFi UDM Pro SE — gateway + controller}
|
||||
# Irvine is not its own DNS site: it is a single box (irv-ml1) reached over
|
||||
# the headscale mesh, so it is named under nh3 rather than getting its own
|
||||
|
||||
@@ -0,0 +1,89 @@
|
||||
# Generic: create a Debian 13 genericcloud VM on nh3-pve-2 with cloud-init (user vh with the operator's keys plus
|
||||
# the infra-ops bootstrap key, static address on VLAN 50). Same steps as playbooks/nh3-albok-vm.yaml, parameterised.
|
||||
# scripts/elway infra-ops@10.100.250.62 --playbook playbooks/nh3-pve-2-cloudinit-vm.yaml \
|
||||
# --var vmid=111 --var name=nh3-svos --var ip=10.100.50.43/24 --var cores=4 --var memory=8192 --var disk=100G \
|
||||
# --var tags=svos --var "description=..."
|
||||
# Then: bootstrap-infra-ops-user.yaml AS vh, then the host's own base playbook (which takes the bootstrap key off vh).
|
||||
vars:
|
||||
vmid: ""
|
||||
name: ""
|
||||
ip: ""
|
||||
gw: 10.100.50.1
|
||||
dns: 10.100.50.40 10.250.50.70
|
||||
cores: "4"
|
||||
memory: "8192"
|
||||
disk: 100G
|
||||
tags: ""
|
||||
description: ""
|
||||
img_url: https://cloud.debian.org/images/cloud/trixie/latest
|
||||
img: debian-13-genericcloud-amd64.qcow2
|
||||
img_dir: /var/lib/vz/import
|
||||
|
||||
steps:
|
||||
- name: refuse unless this is nh3-pve-2, vmbr0 is VLAN-aware, and the VMID and address are free
|
||||
sudo: true
|
||||
shell: |
|
||||
set -e
|
||||
test "$(hostname)" = nh3-pve-2
|
||||
test "$(cat /sys/class/net/vmbr0/bridge/vlan_filtering)" = 1
|
||||
if ping -c2 -W1 $(echo {{ ip }} | cut -d/ -f1) >/dev/null 2>&1; then echo "{{ ip }} ANSWERS — taken"; exit 1; fi
|
||||
changed_when: "false"
|
||||
when: "! qm status {{ vmid }} >/dev/null 2>&1"
|
||||
|
||||
- name: fetch the Debian 13 genericcloud image and check it against SHA512SUMS
|
||||
sudo: true
|
||||
shell: |
|
||||
set -e
|
||||
install -d -m 0755 {{ img_dir }}
|
||||
cd {{ img_dir }}
|
||||
curl -fsSL -o SHA512SUMS.trixie {{ img_url }}/SHA512SUMS
|
||||
curl -fsSL -o {{ img }}.part {{ img_url }}/{{ img }}
|
||||
want=$(awk '$2=="{{ img }}"{print $1}' SHA512SUMS.trixie)
|
||||
test -n "$want"
|
||||
echo "$want {{ img }}.part" | sha512sum -c -
|
||||
mv {{ img }}.part {{ img }}
|
||||
when: "! qm status {{ vmid }} >/dev/null 2>&1"
|
||||
|
||||
- name: create VM {{ vmid }} ({{ name }})
|
||||
sudo: true
|
||||
shell: |
|
||||
set -e
|
||||
qm create {{ vmid }} --name {{ name }} --ostype l26 --cpu x86-64-v3 --cores {{ cores }} --memory {{ memory }} \
|
||||
--scsihw virtio-scsi-single --agent enabled=1 --onboot 1 --tags {{ tags }} \
|
||||
--net0 virtio,bridge=vmbr0,tag=50,firewall=1 \
|
||||
--serial0 socket --vga serial0 \
|
||||
--description "{{ description }}"
|
||||
qm set {{ vmid }} --scsi0 vmstore:0,import-from={{ img_dir }}/{{ img }},discard=on,ssd=1,iothread=1
|
||||
qm disk resize {{ vmid }} scsi0 {{ disk }}
|
||||
qm set {{ vmid }} --ide2 vmstore:cloudinit --boot order=scsi0
|
||||
creates: /etc/pve/qemu-server/{{ vmid }}.conf
|
||||
|
||||
- name: cloud-init — user vh, keys, static address, resolvers
|
||||
sudo: true
|
||||
shell: |
|
||||
set -e
|
||||
k=$(mktemp)
|
||||
cat > "$k" <<'EOF'
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN+1HBwfXrkfTYWdcnWCjLJ6VLAGC87gxH5h5vKaaA3c infra-ops@pfi-fleet
|
||||
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKGm/lJslGEL2xDBY/7LdUc0Q4GyuxwFtGspYTe6WsVE lkrav@VHHomeG13
|
||||
ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDP/AwgaLghPoQi9RDt+m/9H9jLHDoP93WgzczlhZlSvZoQ5qDpWu5oAQlRwImiWhVL1ClK4FwEz9JULsta7Uq3FaiQvs2ltevrW/EpNbhAfxZa4Z1ELrPAOO8SSlhZ+Zer33SPkfJD9t3Hi9TXheCaANiEtE6hH1nCVLpHWQdbzy+L7EyG8z+/RzNXwwIL8f0BZ8n7FvFujgwc1OQTXlg4fiW3FdB3uzJMVRT59IIsPEq/ODGZZ6XGtHy24Ewcsi8l78I+oKaPdMl8ZXNBQrNb0MPIJnHkQwTrzlDKZ0Oh1UKm7I9i9hDMB/M2+aQ+6MxzY5TLZyDvRYd8R3j9Mnrp3ouCnNcklGAkX7i8hNJ2y8xCbwOeP8sMd+VtQ6hBbNa6KAEaAgGuWHHS0KGGO4HjtvDxJH8e7BnGzveIeCUGLVKMrg08w9nqF6Kzf3Y72ou0yCmnu7kKqocS1Pcr+e5E1MdT4brc2BfYkzqExLp8gxQaJ1Zas2OXPNXpAxL58xc= lkraven@nh3-dev
|
||||
EOF
|
||||
sed -i 's/^ *//' "$k"
|
||||
qm set {{ vmid }} --ciuser vh --sshkeys "$k" --ipconfig0 ip={{ ip }},gw={{ gw }} \
|
||||
--nameserver "{{ dns }}" --searchdomain nh3.internal --ciupgrade 1
|
||||
rm -f "$k"
|
||||
when: "! qm config {{ vmid }} | grep -q '^ciuser: vh'"
|
||||
|
||||
- name: start VM {{ vmid }}
|
||||
sudo: true
|
||||
shell: qm start {{ vmid }}
|
||||
when: "! qm status {{ vmid }} | grep -q running"
|
||||
|
||||
verify:
|
||||
- name: VM is running with the intended shape
|
||||
sudo: true
|
||||
shell: |
|
||||
qm status {{ vmid }}
|
||||
qm config {{ vmid }} | grep -E '^(name|cores|cpu|memory|net0|scsi0|ipconfig0|onboot|ciuser):'
|
||||
qm status {{ vmid }} | grep -q running
|
||||
changed_when: "false"
|
||||
@@ -0,0 +1,80 @@
|
||||
# Base build for nh3-svos (VM 111 on nh3-pve-2, 10.100.50.43): the host for the NEW SVOS operating system
|
||||
# (corviduo/svoperatingsystem). Requested by svos-dev relaying Prime, 2026-10-05. A SEPARATE instance: the existing
|
||||
# High Seat (svos.service on nh3-dev :8770) and Miranda are untouched.
|
||||
# scripts/elway infra-ops@10.100.50.43 --playbook playbooks/nh3-svos-host.yaml
|
||||
# Order: nh3-pve-2-cloudinit-vm.yaml (on nh3-pve-2) → bootstrap-infra-ops-user.yaml AS vh → this.
|
||||
#
|
||||
# Infra owns the box; svos-dev owns the application (install, config, enrollment, acceptance). What this provides:
|
||||
# - service account `svc-svos` (uid/gid 801, nologin; fleet-conventions § 1.3), the only writer of the data root
|
||||
# - /var/lib/svos svc-svos 0700, LOCAL ext4 (the root disk on vmstore): SQLite WAL, one writer, never shared/NFS
|
||||
# - /opt/svos root:svc-svos 2775, the release tree (releases/<id>/ + a `current` link; svos-dev lays it out)
|
||||
# - Python 3.13 (Debian 13) + venv, sqlite3, qemu-guest-agent (vzdump freeze/thaw), timesyncd checked
|
||||
# - /etc/qemu/fsfreeze-hook.d/ exists for the application-consistent snapshot hook svos-dev will add (the guest
|
||||
# agent runs those scripts on vzdump's freeze/thaw)
|
||||
# No Docker: nothing here needs it.
|
||||
steps:
|
||||
- name: take the bootstrap infra-ops key back off vh (vh keeps the operator's keys)
|
||||
sudo: true
|
||||
shell: |
|
||||
set -e
|
||||
f=/home/vh/.ssh/authorized_keys
|
||||
grep -v 'infra-ops@pfi-fleet' "$f" > "$f.new"
|
||||
test -s "$f.new"
|
||||
chown vh:vh "$f.new"; chmod 600 "$f.new"; mv "$f.new" "$f"
|
||||
when: "sudo -n grep -q 'infra-ops@pfi-fleet' /home/vh/.ssh/authorized_keys"
|
||||
|
||||
- name: timezone America/Los_Angeles
|
||||
sudo: true
|
||||
shell: timedatectl set-timezone America/Los_Angeles
|
||||
when: "[ \"$(timedatectl show -p Timezone --value)\" != America/Los_Angeles ]"
|
||||
|
||||
- name: base packages
|
||||
sudo: true
|
||||
shell: DEBIAN_FRONTEND=noninteractive apt-get install -y -q qemu-guest-agent python3 python3-venv sqlite3 rsync jq curl ca-certificates
|
||||
when: "! dpkg -s qemu-guest-agent python3-venv sqlite3 rsync jq >/dev/null 2>&1"
|
||||
|
||||
- name: qemu-guest-agent running
|
||||
sudo: true
|
||||
shell: systemctl start qemu-guest-agent
|
||||
when: "! systemctl is-active --quiet qemu-guest-agent"
|
||||
|
||||
- name: fsfreeze hook directory for the application-consistent snapshot hook
|
||||
sudo: true
|
||||
shell: install -d -o root -g root -m 0755 /etc/qemu/fsfreeze-hook.d
|
||||
changed_when: "false"
|
||||
|
||||
- name: service account svc-svos (uid/gid 801, nologin, home = the data root)
|
||||
sudo: true
|
||||
shell: |
|
||||
set -e
|
||||
getent group 801 >/dev/null && { echo "gid 801 taken"; exit 1; }
|
||||
getent passwd 801 >/dev/null && { echo "uid 801 taken"; exit 1; }
|
||||
groupadd --system --gid 801 svc-svos
|
||||
useradd --system --uid 801 --gid 801 --shell /usr/sbin/nologin --home-dir /var/lib/svos --no-create-home svc-svos
|
||||
when: "! getent passwd svc-svos >/dev/null"
|
||||
|
||||
- name: data root /var/lib/svos (svc-svos 0700) and release tree /opt/svos (root:svc-svos 2775)
|
||||
sudo: true
|
||||
shell: |
|
||||
install -d -o svc-svos -g svc-svos -m 0700 /var/lib/svos
|
||||
install -d -o root -g svc-svos -m 2775 /opt/svos /opt/svos/releases
|
||||
changed_when: "false"
|
||||
|
||||
verify:
|
||||
- name: identities are the fleet pins
|
||||
shell: |
|
||||
test "$(id -u vh)" = 1000 && test "$(id -u infra-ops)" = 850 && test "$(id -u svc-svos)" = 801
|
||||
changed_when: "false"
|
||||
- name: vh no longer carries the infra-ops key
|
||||
sudo: true
|
||||
shell: "! grep -q 'infra-ops@pfi-fleet' /home/vh/.ssh/authorized_keys"
|
||||
changed_when: "false"
|
||||
- name: data root is local ext4 and private
|
||||
sudo: true
|
||||
shell: |
|
||||
test "$(findmnt -T /var/lib/svos -no FSTYPE)" = ext4 && test "$(stat -c '%U %a' /var/lib/svos)" = "svc-svos 700"
|
||||
changed_when: "false"
|
||||
- name: python, sqlite, guest agent, time sync
|
||||
shell: |
|
||||
python3 --version && sqlite3 --version | cut -c1-20 && systemctl is-active qemu-guest-agent && timedatectl show -p NTPSynchronized --value
|
||||
changed_when: "false"
|
||||
@@ -13,6 +13,7 @@ possibly a dev environment for security-software work. First guest: nh3-albok (2
|
||||
| ID | guest | onboot | notes |
|
||||
|---|---|---|---|
|
||||
| 110 | **nh3-albok** (`10.100.50.44`, VLAN 50) | 1 | First guest, 2026-10-04 (albok-dev relaying Prime): runs only albok-service. `servers/nh3-albok/README.md` |
|
||||
| 111 | **nh3-svos** (`10.100.50.43`, VLAN 50) | 1 | 2026-10-05 (svos-dev relaying Prime): the new SVOS OS. `servers/nh3-svos/README.md` |
|
||||
|
||||
VMIDs continue the NH3 numbering (nh3-pve holds 100–109) so a VMID names one guest on the site.
|
||||
|
||||
|
||||
@@ -0,0 +1,40 @@
|
||||
# nh3-svos: host for the NEW SVOS operating system (VM 111 on nh3-pve-2, NH3)
|
||||
|
||||
Built 2026-10-05 at svos-dev's request, relaying Prime ("stand up a dedicated VM for it on nh3-pve-2"). It runs the
|
||||
new SVOS (repo `corviduo/svoperatingsystem`): a FastAPI/uvicorn kernel (SQLite WAL, synchronous FULL, one writer),
|
||||
an interface connector, an optional voice adapter and a static phone/desktop UI.
|
||||
**It is a separate instance.** The existing High Seat (`svos.service` on nh3-dev, `:8770`) and Miranda are NOT
|
||||
migrated by this host.
|
||||
|
||||
**Ownership split:** infra-ops owns the VM, OS, access, backups and ingress. svos-dev owns the application: install,
|
||||
configuration, enrollment and acceptance.
|
||||
|
||||
| | |
|
||||
|---|---|
|
||||
| Address | `10.100.50.43`, VLAN 50 (nh3-servers), static via cloud-init; `nh3-svos.nh3.internal` |
|
||||
| Guest | VM **111** on **nh3-pve-2**, `onboot 1`, tag `svos` |
|
||||
| Shape | 4 vCPU `x86-64-v3`, 8 GiB, 100 GB on `vmstore` (local NVMe LVM-thin, discard on). nh3-pve-2 had 47 GB RAM and 946 GB vmstore free at build |
|
||||
| OS | Debian 13 genericcloud, Python 3.13 + venv, SQLite 3.46, systemd-timesyncd (synced), qemu-guest-agent |
|
||||
| Identities | `vh` 1000 (operator keys + lkraven@nh3-dev, so svos-dev's session can ssh in; NOPASSWD sudo from cloud-init), `infra-ops` 850, **`svc-svos` 801** (nologin; the only writer of the data root) |
|
||||
| Data root | `/var/lib/svos`, svc-svos 0700, on the local root ext4. Never NFS, never shared |
|
||||
| Releases | `/opt/svos` root:svc-svos 2775, with `releases/` for svos-dev's layout. The git checkout is not a runtime dependency |
|
||||
| Docker | none, by design |
|
||||
| Backups | nh3-pve-2 vzdump job, nightly **21:30**, `all 1` → pbs-ana namespace `nh3-pve-2` (mirrored to pbs-nh3 at 06:30), snapshot mode with guest-agent fs-freeze |
|
||||
| App-consistent hook | `/etc/qemu/fsfreeze-hook.d/` exists. The guest agent runs those scripts on vzdump's freeze/thaw, which is where svos-dev's SQLite checkpoint hook belongs. Until it lands, backups are crash-consistent (fine for WAL + synchronous FULL, but not the stated requirement) |
|
||||
| Monitoring | not yet. Beszel needs the native agent here (no Docker); that is pending together with nh3-albok's |
|
||||
|
||||
## Build (reproducible)
|
||||
|
||||
```bash
|
||||
scripts/elway infra-ops@10.100.250.62 --playbook playbooks/nh3-pve-2-cloudinit-vm.yaml --var vmid=111 \
|
||||
--var name=nh3-svos --var ip=10.100.50.43/24 --var cores=4 --var memory=8192 --var disk=100G --var tags=svos \
|
||||
--var "description=..."
|
||||
scripts/elway vh@10.100.50.43 --playbook playbooks/bootstrap-infra-ops-user.yaml
|
||||
scripts/elway infra-ops@10.100.50.43 --playbook playbooks/nh3-svos-host.yaml
|
||||
```
|
||||
|
||||
## Ingress / auth: NOT built yet, proposal pending (Prime + svos-dev)
|
||||
|
||||
App listeners stay private (loopback or a Unix socket). The front door has to give the browser **HTTPS**: the UI and the
|
||||
voice adapter need a secure context for the microphone. It also has to give the kernel's adapter a **verified identity**
|
||||
in `Tailscale-User-Login`, with any browser-supplied copy stripped. See the svos-dev thread of 2026-10-05.
|
||||
@@ -0,0 +1 @@
|
||||
infra-ops@10.100.50.43
|
||||
@@ -0,0 +1,77 @@
|
||||
|
||||
===== HOST =====
|
||||
|
||||
Hostname: nh3-svos.nh3.internal
|
||||
Date: 2026-10-05T18:59:30-07:00
|
||||
Uptime: up 1 minute
|
||||
OS: Debian GNU/Linux 13 (trixie)
|
||||
Kernel: 6.12.111+deb13-cloud-amd64
|
||||
Arch: x86_64
|
||||
|
||||
===== HARDWARE =====
|
||||
|
||||
CPU cores: 4
|
||||
CPU model: QEMU Virtual CPU version 2.5+
|
||||
MemTotal: 7.8 GB
|
||||
MemAvailable: 7.4 GB
|
||||
|
||||
===== GPUS =====
|
||||
|
||||
nvidia-smi not present (no NVIDIA GPUs or driver not installed)
|
||||
|
||||
===== FILESYSTEMS (df) =====
|
||||
|
||||
Filesystem Size Used Avail Use% Mounted on
|
||||
/dev/sda1 99G 862M 94G 1% /
|
||||
/dev/sda15 124M 8.9M 115M 8% /boot/efi
|
||||
|
||||
===== PERSISTENT MOUNTS (/etc/fstab, non-comment) =====
|
||||
|
||||
PARTUUID=fd202e72-0241-4c3b-953d-ffe506ae6cfc / ext4 rw,discard,errors=remount-ro,x-systemd.growfs 0 1
|
||||
PARTUUID=b558256e-e822-4787-9bd2-c4c47dfb54d9 /boot/efi vfat defaults,umask=077 0 2
|
||||
|
||||
===== TARGETED DATA PATHS =====
|
||||
|
||||
/opt (total: 12K)
|
||||
total 12
|
||||
drwxr-xr-x 3 root root 4096 2026-10-05 18:58 .
|
||||
drwxr-xr-x 18 root root 4096 2026-10-05 18:58 ..
|
||||
drwxrwsr-x 3 root svc-svos 4096 2026-10-05 18:58 svos
|
||||
|
||||
/srv (total: 4.0K)
|
||||
total 8
|
||||
drwxr-xr-x 2 root root 4096 2026-09-30 21:57 .
|
||||
drwxr-xr-x 18 root root 4096 2026-10-05 18:58 ..
|
||||
|
||||
|
||||
===== DOCKER =====
|
||||
|
||||
docker not installed
|
||||
|
||||
===== COMPOSE FILES (/opt/docker/compose/) =====
|
||||
|
||||
/opt/docker/compose not present
|
||||
|
||||
===== CONFIG LAYOUT (/opt/docker/conf/ — top 200 entries) =====
|
||||
|
||||
/opt/docker/conf not present
|
||||
|
||||
===== LISTENING PORTS =====
|
||||
|
||||
0.0.0.0:22
|
||||
0.0.0.0:5355
|
||||
127.0.0.53%lo:53
|
||||
127.0.0.54:53
|
||||
[::]:22
|
||||
[::]:5355
|
||||
|
||||
===== MODEL / HUGGINGFACE CACHES =====
|
||||
|
||||
|
||||
===== DOCKER-ADJACENT SYSTEMD SERVICES =====
|
||||
|
||||
(none matching)
|
||||
|
||||
===== DONE =====
|
||||
|
||||
Paste the above back into the chat, or pass a path as argv[1] to save.
|
||||
@@ -19,6 +19,7 @@ pfi-gx10 infra-ops@10.100.50.60
|
||||
nh3-dev infra-ops@10.100.10.50
|
||||
nh3-docker infra-ops@10.100.50.40
|
||||
nh3-albok infra-ops@10.100.50.44
|
||||
nh3-svos infra-ops@10.100.50.43
|
||||
nh3-extdev infra-ops@10.100.50.42
|
||||
nh3-ml1 infra-ops@10.100.50.80
|
||||
esh-docker-vm infra-ops@10.0.50.45
|
||||
|
||||
Reference in New Issue
Block a user