diff --git a/CLAUDE.md b/CLAUDE.md index 3dcdb67..7dc8b74 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -362,6 +362,7 @@ Observed and standardized across servers: | nh3-pve | 10.100.250.60 | NH3 | Proxmox VE hypervisor | `servers/nh3-pve/README.md` | | nh3-pve-2 | 10.100.250.62 | NH3 | Proxmox VE hypervisor (Minisforum MS-03, standalone, not clustered); purpose TBD, first guest nh3-albok | `servers/nh3-pve-2/README.md` | | nh3-albok | 10.100.50.44 | NH3 | VM 110 on nh3-pve-2 — runs **only** albok-service (fleet knowledgebase); no Docker API on tcp, no socket containers, by design | `servers/nh3-albok/README.md` | +| nh3-svos | 10.100.50.43 | NH3 | VM 111 on nh3-pve-2 — the NEW SVOS operating system (svos-dev owns the app); separate from the High Seat on nh3-dev | `servers/nh3-svos/README.md` | | nh3-nas | 10.100.50.50 | NH3 | Synology RS2418+ — NFS exports, rest-server-nh3, PBS-NH3 datastore backend | `servers/nh3-nas/README.md` | | pbs-nh3 | 10.100.50.90 | NH3 | Proxmox Backup Server — DR mirror (VM on nh3-pve, NFS datastore on nh3-nas); syncs from pbs-ana | `servers/pbs-nh3/README.md` | | esh-docker-vm | 10.0.50.45 | ESH home lab (`esteban.net`, `10.0.50.0/24`) | Home-lab Docker host (VM on esh-pve) | `servers/esh-docker-vm/README.md` | diff --git a/dns/internal.yaml b/dns/internal.yaml index 5fe8c44..e04aa9c 100644 --- a/dns/internal.yaml +++ b/dns/internal.yaml @@ -86,6 +86,7 @@ hosts: - {name: nh3-pve-2-amt, site: nh3, v4: 10.100.250.63, note: Intel AMT 21 (vPro) on nh3-pve-2's (MS-03) I226-LM — UDM port 5 (native nh3-mgmt), DHCP reservation for 38:05:25:3b:a0:a6; LAN mgmt goes dark once CIRA is set up} - {name: pbs-nh3, site: nh3, v4: 10.100.50.90, note: Proxmox Backup Server — DR mirror} - {name: nh3-albok, site: nh3, v4: 10.100.50.44, note: VM 110 on nh3-pve-2 — runs ONLY albok-service (no Docker API on tcp, no socket containers)} + - {name: nh3-svos, site: nh3, v4: 10.100.50.43, note: VM 111 on nh3-pve-2 — the NEW SVOS operating system (svos-dev); separate from the High Seat on nh3-dev} - {name: nh3-gw, site: nh3, v4: 10.100.0.1, note: UniFi UDM Pro SE — gateway + controller} # Irvine is not its own DNS site: it is a single box (irv-ml1) reached over # the headscale mesh, so it is named under nh3 rather than getting its own diff --git a/playbooks/nh3-pve-2-cloudinit-vm.yaml b/playbooks/nh3-pve-2-cloudinit-vm.yaml new file mode 100644 index 0000000..80c549e --- /dev/null +++ b/playbooks/nh3-pve-2-cloudinit-vm.yaml @@ -0,0 +1,89 @@ +# Generic: create a Debian 13 genericcloud VM on nh3-pve-2 with cloud-init (user vh with the operator's keys plus +# the infra-ops bootstrap key, static address on VLAN 50). Same steps as playbooks/nh3-albok-vm.yaml, parameterised. +# scripts/elway infra-ops@10.100.250.62 --playbook playbooks/nh3-pve-2-cloudinit-vm.yaml \ +# --var vmid=111 --var name=nh3-svos --var ip=10.100.50.43/24 --var cores=4 --var memory=8192 --var disk=100G \ +# --var tags=svos --var "description=..." +# Then: bootstrap-infra-ops-user.yaml AS vh, then the host's own base playbook (which takes the bootstrap key off vh). +vars: + vmid: "" + name: "" + ip: "" + gw: 10.100.50.1 + dns: 10.100.50.40 10.250.50.70 + cores: "4" + memory: "8192" + disk: 100G + tags: "" + description: "" + img_url: https://cloud.debian.org/images/cloud/trixie/latest + img: debian-13-genericcloud-amd64.qcow2 + img_dir: /var/lib/vz/import + +steps: + - name: refuse unless this is nh3-pve-2, vmbr0 is VLAN-aware, and the VMID and address are free + sudo: true + shell: | + set -e + test "$(hostname)" = nh3-pve-2 + test "$(cat /sys/class/net/vmbr0/bridge/vlan_filtering)" = 1 + if ping -c2 -W1 $(echo {{ ip }} | cut -d/ -f1) >/dev/null 2>&1; then echo "{{ ip }} ANSWERS — taken"; exit 1; fi + changed_when: "false" + when: "! qm status {{ vmid }} >/dev/null 2>&1" + + - name: fetch the Debian 13 genericcloud image and check it against SHA512SUMS + sudo: true + shell: | + set -e + install -d -m 0755 {{ img_dir }} + cd {{ img_dir }} + curl -fsSL -o SHA512SUMS.trixie {{ img_url }}/SHA512SUMS + curl -fsSL -o {{ img }}.part {{ img_url }}/{{ img }} + want=$(awk '$2=="{{ img }}"{print $1}' SHA512SUMS.trixie) + test -n "$want" + echo "$want {{ img }}.part" | sha512sum -c - + mv {{ img }}.part {{ img }} + when: "! qm status {{ vmid }} >/dev/null 2>&1" + + - name: create VM {{ vmid }} ({{ name }}) + sudo: true + shell: | + set -e + qm create {{ vmid }} --name {{ name }} --ostype l26 --cpu x86-64-v3 --cores {{ cores }} --memory {{ memory }} \ + --scsihw virtio-scsi-single --agent enabled=1 --onboot 1 --tags {{ tags }} \ + --net0 virtio,bridge=vmbr0,tag=50,firewall=1 \ + --serial0 socket --vga serial0 \ + --description "{{ description }}" + qm set {{ vmid }} --scsi0 vmstore:0,import-from={{ img_dir }}/{{ img }},discard=on,ssd=1,iothread=1 + qm disk resize {{ vmid }} scsi0 {{ disk }} + qm set {{ vmid }} --ide2 vmstore:cloudinit --boot order=scsi0 + creates: /etc/pve/qemu-server/{{ vmid }}.conf + + - name: cloud-init — user vh, keys, static address, resolvers + sudo: true + shell: | + set -e + k=$(mktemp) + cat > "$k" <<'EOF' + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN+1HBwfXrkfTYWdcnWCjLJ6VLAGC87gxH5h5vKaaA3c infra-ops@pfi-fleet + ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKGm/lJslGEL2xDBY/7LdUc0Q4GyuxwFtGspYTe6WsVE lkrav@VHHomeG13 + ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDP/AwgaLghPoQi9RDt+m/9H9jLHDoP93WgzczlhZlSvZoQ5qDpWu5oAQlRwImiWhVL1ClK4FwEz9JULsta7Uq3FaiQvs2ltevrW/EpNbhAfxZa4Z1ELrPAOO8SSlhZ+Zer33SPkfJD9t3Hi9TXheCaANiEtE6hH1nCVLpHWQdbzy+L7EyG8z+/RzNXwwIL8f0BZ8n7FvFujgwc1OQTXlg4fiW3FdB3uzJMVRT59IIsPEq/ODGZZ6XGtHy24Ewcsi8l78I+oKaPdMl8ZXNBQrNb0MPIJnHkQwTrzlDKZ0Oh1UKm7I9i9hDMB/M2+aQ+6MxzY5TLZyDvRYd8R3j9Mnrp3ouCnNcklGAkX7i8hNJ2y8xCbwOeP8sMd+VtQ6hBbNa6KAEaAgGuWHHS0KGGO4HjtvDxJH8e7BnGzveIeCUGLVKMrg08w9nqF6Kzf3Y72ou0yCmnu7kKqocS1Pcr+e5E1MdT4brc2BfYkzqExLp8gxQaJ1Zas2OXPNXpAxL58xc= lkraven@nh3-dev + EOF + sed -i 's/^ *//' "$k" + qm set {{ vmid }} --ciuser vh --sshkeys "$k" --ipconfig0 ip={{ ip }},gw={{ gw }} \ + --nameserver "{{ dns }}" --searchdomain nh3.internal --ciupgrade 1 + rm -f "$k" + when: "! qm config {{ vmid }} | grep -q '^ciuser: vh'" + + - name: start VM {{ vmid }} + sudo: true + shell: qm start {{ vmid }} + when: "! qm status {{ vmid }} | grep -q running" + +verify: + - name: VM is running with the intended shape + sudo: true + shell: | + qm status {{ vmid }} + qm config {{ vmid }} | grep -E '^(name|cores|cpu|memory|net0|scsi0|ipconfig0|onboot|ciuser):' + qm status {{ vmid }} | grep -q running + changed_when: "false" diff --git a/playbooks/nh3-svos-host.yaml b/playbooks/nh3-svos-host.yaml new file mode 100644 index 0000000..c2bf187 --- /dev/null +++ b/playbooks/nh3-svos-host.yaml @@ -0,0 +1,80 @@ +# Base build for nh3-svos (VM 111 on nh3-pve-2, 10.100.50.43): the host for the NEW SVOS operating system +# (corviduo/svoperatingsystem). Requested by svos-dev relaying Prime, 2026-10-05. A SEPARATE instance: the existing +# High Seat (svos.service on nh3-dev :8770) and Miranda are untouched. +# scripts/elway infra-ops@10.100.50.43 --playbook playbooks/nh3-svos-host.yaml +# Order: nh3-pve-2-cloudinit-vm.yaml (on nh3-pve-2) → bootstrap-infra-ops-user.yaml AS vh → this. +# +# Infra owns the box; svos-dev owns the application (install, config, enrollment, acceptance). What this provides: +# - service account `svc-svos` (uid/gid 801, nologin; fleet-conventions § 1.3), the only writer of the data root +# - /var/lib/svos svc-svos 0700, LOCAL ext4 (the root disk on vmstore): SQLite WAL, one writer, never shared/NFS +# - /opt/svos root:svc-svos 2775, the release tree (releases// + a `current` link; svos-dev lays it out) +# - Python 3.13 (Debian 13) + venv, sqlite3, qemu-guest-agent (vzdump freeze/thaw), timesyncd checked +# - /etc/qemu/fsfreeze-hook.d/ exists for the application-consistent snapshot hook svos-dev will add (the guest +# agent runs those scripts on vzdump's freeze/thaw) +# No Docker: nothing here needs it. +steps: + - name: take the bootstrap infra-ops key back off vh (vh keeps the operator's keys) + sudo: true + shell: | + set -e + f=/home/vh/.ssh/authorized_keys + grep -v 'infra-ops@pfi-fleet' "$f" > "$f.new" + test -s "$f.new" + chown vh:vh "$f.new"; chmod 600 "$f.new"; mv "$f.new" "$f" + when: "sudo -n grep -q 'infra-ops@pfi-fleet' /home/vh/.ssh/authorized_keys" + + - name: timezone America/Los_Angeles + sudo: true + shell: timedatectl set-timezone America/Los_Angeles + when: "[ \"$(timedatectl show -p Timezone --value)\" != America/Los_Angeles ]" + + - name: base packages + sudo: true + shell: DEBIAN_FRONTEND=noninteractive apt-get install -y -q qemu-guest-agent python3 python3-venv sqlite3 rsync jq curl ca-certificates + when: "! dpkg -s qemu-guest-agent python3-venv sqlite3 rsync jq >/dev/null 2>&1" + + - name: qemu-guest-agent running + sudo: true + shell: systemctl start qemu-guest-agent + when: "! systemctl is-active --quiet qemu-guest-agent" + + - name: fsfreeze hook directory for the application-consistent snapshot hook + sudo: true + shell: install -d -o root -g root -m 0755 /etc/qemu/fsfreeze-hook.d + changed_when: "false" + + - name: service account svc-svos (uid/gid 801, nologin, home = the data root) + sudo: true + shell: | + set -e + getent group 801 >/dev/null && { echo "gid 801 taken"; exit 1; } + getent passwd 801 >/dev/null && { echo "uid 801 taken"; exit 1; } + groupadd --system --gid 801 svc-svos + useradd --system --uid 801 --gid 801 --shell /usr/sbin/nologin --home-dir /var/lib/svos --no-create-home svc-svos + when: "! getent passwd svc-svos >/dev/null" + + - name: data root /var/lib/svos (svc-svos 0700) and release tree /opt/svos (root:svc-svos 2775) + sudo: true + shell: | + install -d -o svc-svos -g svc-svos -m 0700 /var/lib/svos + install -d -o root -g svc-svos -m 2775 /opt/svos /opt/svos/releases + changed_when: "false" + +verify: + - name: identities are the fleet pins + shell: | + test "$(id -u vh)" = 1000 && test "$(id -u infra-ops)" = 850 && test "$(id -u svc-svos)" = 801 + changed_when: "false" + - name: vh no longer carries the infra-ops key + sudo: true + shell: "! grep -q 'infra-ops@pfi-fleet' /home/vh/.ssh/authorized_keys" + changed_when: "false" + - name: data root is local ext4 and private + sudo: true + shell: | + test "$(findmnt -T /var/lib/svos -no FSTYPE)" = ext4 && test "$(stat -c '%U %a' /var/lib/svos)" = "svc-svos 700" + changed_when: "false" + - name: python, sqlite, guest agent, time sync + shell: | + python3 --version && sqlite3 --version | cut -c1-20 && systemctl is-active qemu-guest-agent && timedatectl show -p NTPSynchronized --value + changed_when: "false" diff --git a/servers/nh3-pve-2/README.md b/servers/nh3-pve-2/README.md index b6fde63..5a55fbb 100644 --- a/servers/nh3-pve-2/README.md +++ b/servers/nh3-pve-2/README.md @@ -13,6 +13,7 @@ possibly a dev environment for security-software work. First guest: nh3-albok (2 | ID | guest | onboot | notes | |---|---|---|---| | 110 | **nh3-albok** (`10.100.50.44`, VLAN 50) | 1 | First guest, 2026-10-04 (albok-dev relaying Prime): runs only albok-service. `servers/nh3-albok/README.md` | +| 111 | **nh3-svos** (`10.100.50.43`, VLAN 50) | 1 | 2026-10-05 (svos-dev relaying Prime): the new SVOS OS. `servers/nh3-svos/README.md` | VMIDs continue the NH3 numbering (nh3-pve holds 100–109) so a VMID names one guest on the site. diff --git a/servers/nh3-svos/README.md b/servers/nh3-svos/README.md new file mode 100644 index 0000000..c09bcf2 --- /dev/null +++ b/servers/nh3-svos/README.md @@ -0,0 +1,40 @@ +# nh3-svos: host for the NEW SVOS operating system (VM 111 on nh3-pve-2, NH3) + +Built 2026-10-05 at svos-dev's request, relaying Prime ("stand up a dedicated VM for it on nh3-pve-2"). It runs the +new SVOS (repo `corviduo/svoperatingsystem`): a FastAPI/uvicorn kernel (SQLite WAL, synchronous FULL, one writer), +an interface connector, an optional voice adapter and a static phone/desktop UI. +**It is a separate instance.** The existing High Seat (`svos.service` on nh3-dev, `:8770`) and Miranda are NOT +migrated by this host. + +**Ownership split:** infra-ops owns the VM, OS, access, backups and ingress. svos-dev owns the application: install, +configuration, enrollment and acceptance. + +| | | +|---|---| +| Address | `10.100.50.43`, VLAN 50 (nh3-servers), static via cloud-init; `nh3-svos.nh3.internal` | +| Guest | VM **111** on **nh3-pve-2**, `onboot 1`, tag `svos` | +| Shape | 4 vCPU `x86-64-v3`, 8 GiB, 100 GB on `vmstore` (local NVMe LVM-thin, discard on). nh3-pve-2 had 47 GB RAM and 946 GB vmstore free at build | +| OS | Debian 13 genericcloud, Python 3.13 + venv, SQLite 3.46, systemd-timesyncd (synced), qemu-guest-agent | +| Identities | `vh` 1000 (operator keys + lkraven@nh3-dev, so svos-dev's session can ssh in; NOPASSWD sudo from cloud-init), `infra-ops` 850, **`svc-svos` 801** (nologin; the only writer of the data root) | +| Data root | `/var/lib/svos`, svc-svos 0700, on the local root ext4. Never NFS, never shared | +| Releases | `/opt/svos` root:svc-svos 2775, with `releases/` for svos-dev's layout. The git checkout is not a runtime dependency | +| Docker | none, by design | +| Backups | nh3-pve-2 vzdump job, nightly **21:30**, `all 1` → pbs-ana namespace `nh3-pve-2` (mirrored to pbs-nh3 at 06:30), snapshot mode with guest-agent fs-freeze | +| App-consistent hook | `/etc/qemu/fsfreeze-hook.d/` exists. The guest agent runs those scripts on vzdump's freeze/thaw, which is where svos-dev's SQLite checkpoint hook belongs. Until it lands, backups are crash-consistent (fine for WAL + synchronous FULL, but not the stated requirement) | +| Monitoring | not yet. Beszel needs the native agent here (no Docker); that is pending together with nh3-albok's | + +## Build (reproducible) + +```bash +scripts/elway infra-ops@10.100.250.62 --playbook playbooks/nh3-pve-2-cloudinit-vm.yaml --var vmid=111 \ + --var name=nh3-svos --var ip=10.100.50.43/24 --var cores=4 --var memory=8192 --var disk=100G --var tags=svos \ + --var "description=..." +scripts/elway vh@10.100.50.43 --playbook playbooks/bootstrap-infra-ops-user.yaml +scripts/elway infra-ops@10.100.50.43 --playbook playbooks/nh3-svos-host.yaml +``` + +## Ingress / auth: NOT built yet, proposal pending (Prime + svos-dev) + +App listeners stay private (loopback or a Unix socket). The front door has to give the browser **HTTPS**: the UI and the +voice adapter need a secure context for the microphone. It also has to give the kernel's adapter a **verified identity** +in `Tailscale-User-Login`, with any browser-supplied copy stripped. See the svos-dev thread of 2026-10-05. diff --git a/servers/nh3-svos/ssh-target b/servers/nh3-svos/ssh-target new file mode 100644 index 0000000..754c41a --- /dev/null +++ b/servers/nh3-svos/ssh-target @@ -0,0 +1 @@ +infra-ops@10.100.50.43 diff --git a/servers/nh3-svos/system-details.txt b/servers/nh3-svos/system-details.txt new file mode 100644 index 0000000..40dddc7 --- /dev/null +++ b/servers/nh3-svos/system-details.txt @@ -0,0 +1,77 @@ + +===== HOST ===== + +Hostname: nh3-svos.nh3.internal +Date: 2026-10-05T18:59:30-07:00 +Uptime: up 1 minute +OS: Debian GNU/Linux 13 (trixie) +Kernel: 6.12.111+deb13-cloud-amd64 +Arch: x86_64 + +===== HARDWARE ===== + +CPU cores: 4 +CPU model: QEMU Virtual CPU version 2.5+ +MemTotal: 7.8 GB +MemAvailable: 7.4 GB + +===== GPUS ===== + +nvidia-smi not present (no NVIDIA GPUs or driver not installed) + +===== FILESYSTEMS (df) ===== + +Filesystem Size Used Avail Use% Mounted on +/dev/sda1 99G 862M 94G 1% / +/dev/sda15 124M 8.9M 115M 8% /boot/efi + +===== PERSISTENT MOUNTS (/etc/fstab, non-comment) ===== + +PARTUUID=fd202e72-0241-4c3b-953d-ffe506ae6cfc / ext4 rw,discard,errors=remount-ro,x-systemd.growfs 0 1 +PARTUUID=b558256e-e822-4787-9bd2-c4c47dfb54d9 /boot/efi vfat defaults,umask=077 0 2 + +===== TARGETED DATA PATHS ===== + +/opt (total: 12K) + total 12 + drwxr-xr-x 3 root root 4096 2026-10-05 18:58 . + drwxr-xr-x 18 root root 4096 2026-10-05 18:58 .. + drwxrwsr-x 3 root svc-svos 4096 2026-10-05 18:58 svos + +/srv (total: 4.0K) + total 8 + drwxr-xr-x 2 root root 4096 2026-09-30 21:57 . + drwxr-xr-x 18 root root 4096 2026-10-05 18:58 .. + + +===== DOCKER ===== + +docker not installed + +===== COMPOSE FILES (/opt/docker/compose/) ===== + +/opt/docker/compose not present + +===== CONFIG LAYOUT (/opt/docker/conf/ — top 200 entries) ===== + +/opt/docker/conf not present + +===== LISTENING PORTS ===== + +0.0.0.0:22 +0.0.0.0:5355 +127.0.0.53%lo:53 +127.0.0.54:53 +[::]:22 +[::]:5355 + +===== MODEL / HUGGINGFACE CACHES ===== + + +===== DOCKER-ADJACENT SYSTEMD SERVICES ===== + +(none matching) + +===== DONE ===== + +Paste the above back into the chat, or pass a path as argv[1] to save. diff --git a/services/sudo-io-archive/hosts b/services/sudo-io-archive/hosts index 9a1c163..9b9aa5f 100644 --- a/services/sudo-io-archive/hosts +++ b/services/sudo-io-archive/hosts @@ -19,6 +19,7 @@ pfi-gx10 infra-ops@10.100.50.60 nh3-dev infra-ops@10.100.10.50 nh3-docker infra-ops@10.100.50.40 nh3-albok infra-ops@10.100.50.44 +nh3-svos infra-ops@10.100.50.43 nh3-extdev infra-ops@10.100.50.42 nh3-ml1 infra-ops@10.100.50.80 esh-docker-vm infra-ops@10.0.50.45