feat(nh3-svos): VM 111 on nh3-pve-2 for the new SVOS (svos-dev, Prime); generic cloud-init VM playbook

CLAUDE.md

@@ -362,6 +362,7 @@ Observed and standardized across servers:
 | nh3-pve | 10.100.250.60 | NH3 | Proxmox VE hypervisor | `servers/nh3-pve/README.md` |
 | nh3-pve-2 | 10.100.250.62 | NH3 | Proxmox VE hypervisor (Minisforum MS-03, standalone, not clustered); purpose TBD, first guest nh3-albok | `servers/nh3-pve-2/README.md` |
 | nh3-albok | 10.100.50.44 | NH3 | VM 110 on nh3-pve-2 — runs **only** albok-service (fleet knowledgebase); no Docker API on tcp, no socket containers, by design | `servers/nh3-albok/README.md` |
+| nh3-svos | 10.100.50.43 | NH3 | VM 111 on nh3-pve-2 — the NEW SVOS operating system (svos-dev owns the app); separate from the High Seat on nh3-dev | `servers/nh3-svos/README.md` |
 | nh3-nas | 10.100.50.50 | NH3 | Synology RS2418+ — NFS exports, rest-server-nh3, PBS-NH3 datastore backend | `servers/nh3-nas/README.md` |
 | pbs-nh3 | 10.100.50.90 | NH3 | Proxmox Backup Server — DR mirror (VM on nh3-pve, NFS datastore on nh3-nas); syncs from pbs-ana | `servers/pbs-nh3/README.md` |
 | esh-docker-vm | 10.0.50.45 | ESH home lab (`esteban.net`, `10.0.50.0/24`) | Home-lab Docker host (VM on esh-pve) | `servers/esh-docker-vm/README.md` |

dns/internal.yaml

@@ -86,6 +86,7 @@ hosts:
   - {name: nh3-pve-2-amt,    site: nh3, v4: 10.100.250.63,  note: Intel AMT 21 (vPro) on nh3-pve-2's (MS-03) I226-LM — UDM port 5 (native nh3-mgmt), DHCP reservation for 38:05:25:3b:a0:a6; LAN mgmt goes dark once CIRA is set up}
   - {name: pbs-nh3,          site: nh3, v4: 10.100.50.90,   note: Proxmox Backup Server — DR mirror}
   - {name: nh3-albok,        site: nh3, v4: 10.100.50.44,   note: VM 110 on nh3-pve-2 — runs ONLY albok-service (no Docker API on tcp, no socket containers)}
+  - {name: nh3-svos,         site: nh3, v4: 10.100.50.43,   note: VM 111 on nh3-pve-2 — the NEW SVOS operating system (svos-dev); separate from the High Seat on nh3-dev}
   - {name: nh3-gw,           site: nh3, v4: 10.100.0.1,     note: UniFi UDM Pro SE — gateway + controller}
   # Irvine is not its own DNS site: it is a single box (irv-ml1) reached over
   # the headscale mesh, so it is named under nh3 rather than getting its own

playbooks/nh3-pve-2-cloudinit-vm.yaml

@@ -0,0 +1,89 @@
+# Generic: create a Debian 13 genericcloud VM on nh3-pve-2 with cloud-init (user vh with the operator's keys plus
+# the infra-ops bootstrap key, static address on VLAN 50). Same steps as playbooks/nh3-albok-vm.yaml, parameterised.
+#   scripts/elway infra-ops@10.100.250.62 --playbook playbooks/nh3-pve-2-cloudinit-vm.yaml \
+#     --var vmid=111 --var name=nh3-svos --var ip=10.100.50.43/24 --var cores=4 --var memory=8192 --var disk=100G \
+#     --var tags=svos --var "description=..."
+# Then: bootstrap-infra-ops-user.yaml AS vh, then the host's own base playbook (which takes the bootstrap key off vh).
+vars:
+  vmid: ""
+  name: ""
+  ip: ""
+  gw: 10.100.50.1
+  dns: 10.100.50.40 10.250.50.70
+  cores: "4"
+  memory: "8192"
+  disk: 100G
+  tags: ""
+  description: ""
+  img_url: https://cloud.debian.org/images/cloud/trixie/latest
+  img: debian-13-genericcloud-amd64.qcow2
+  img_dir: /var/lib/vz/import
+
+steps:
+  - name: refuse unless this is nh3-pve-2, vmbr0 is VLAN-aware, and the VMID and address are free
+    sudo: true
+    shell: |
+      set -e
+      test "$(hostname)" = nh3-pve-2
+      test "$(cat /sys/class/net/vmbr0/bridge/vlan_filtering)" = 1
+      if ping -c2 -W1 $(echo {{ ip }} | cut -d/ -f1) >/dev/null 2>&1; then echo "{{ ip }} ANSWERS — taken"; exit 1; fi
+    changed_when: "false"
+    when: "! qm status {{ vmid }} >/dev/null 2>&1"
+
+  - name: fetch the Debian 13 genericcloud image and check it against SHA512SUMS
+    sudo: true
+    shell: |
+      set -e
+      install -d -m 0755 {{ img_dir }}
+      cd {{ img_dir }}
+      curl -fsSL -o SHA512SUMS.trixie {{ img_url }}/SHA512SUMS
+      curl -fsSL -o {{ img }}.part {{ img_url }}/{{ img }}
+      want=$(awk '$2=="{{ img }}"{print $1}' SHA512SUMS.trixie)
+      test -n "$want"
+      echo "$want  {{ img }}.part" | sha512sum -c -
+      mv {{ img }}.part {{ img }}
+    when: "! qm status {{ vmid }} >/dev/null 2>&1"
+
+  - name: create VM {{ vmid }} ({{ name }})
+    sudo: true
+    shell: |
+      set -e
+      qm create {{ vmid }} --name {{ name }} --ostype l26 --cpu x86-64-v3 --cores {{ cores }} --memory {{ memory }} \
+        --scsihw virtio-scsi-single --agent enabled=1 --onboot 1 --tags {{ tags }} \
+        --net0 virtio,bridge=vmbr0,tag=50,firewall=1 \
+        --serial0 socket --vga serial0 \
+        --description "{{ description }}"
+      qm set {{ vmid }} --scsi0 vmstore:0,import-from={{ img_dir }}/{{ img }},discard=on,ssd=1,iothread=1
+      qm disk resize {{ vmid }} scsi0 {{ disk }}
+      qm set {{ vmid }} --ide2 vmstore:cloudinit --boot order=scsi0
+    creates: /etc/pve/qemu-server/{{ vmid }}.conf
+
+  - name: cloud-init — user vh, keys, static address, resolvers
+    sudo: true
+    shell: |
+      set -e
+      k=$(mktemp)
+      cat > "$k" <<'EOF'
+      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN+1HBwfXrkfTYWdcnWCjLJ6VLAGC87gxH5h5vKaaA3c infra-ops@pfi-fleet
+      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKGm/lJslGEL2xDBY/7LdUc0Q4GyuxwFtGspYTe6WsVE lkrav@VHHomeG13
+      ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDP/AwgaLghPoQi9RDt+m/9H9jLHDoP93WgzczlhZlSvZoQ5qDpWu5oAQlRwImiWhVL1ClK4FwEz9JULsta7Uq3FaiQvs2ltevrW/EpNbhAfxZa4Z1ELrPAOO8SSlhZ+Zer33SPkfJD9t3Hi9TXheCaANiEtE6hH1nCVLpHWQdbzy+L7EyG8z+/RzNXwwIL8f0BZ8n7FvFujgwc1OQTXlg4fiW3FdB3uzJMVRT59IIsPEq/ODGZZ6XGtHy24Ewcsi8l78I+oKaPdMl8ZXNBQrNb0MPIJnHkQwTrzlDKZ0Oh1UKm7I9i9hDMB/M2+aQ+6MxzY5TLZyDvRYd8R3j9Mnrp3ouCnNcklGAkX7i8hNJ2y8xCbwOeP8sMd+VtQ6hBbNa6KAEaAgGuWHHS0KGGO4HjtvDxJH8e7BnGzveIeCUGLVKMrg08w9nqF6Kzf3Y72ou0yCmnu7kKqocS1Pcr+e5E1MdT4brc2BfYkzqExLp8gxQaJ1Zas2OXPNXpAxL58xc= lkraven@nh3-dev
+      EOF
+      sed -i 's/^ *//' "$k"
+      qm set {{ vmid }} --ciuser vh --sshkeys "$k" --ipconfig0 ip={{ ip }},gw={{ gw }} \
+        --nameserver "{{ dns }}" --searchdomain nh3.internal --ciupgrade 1
+      rm -f "$k"
+    when: "! qm config {{ vmid }} | grep -q '^ciuser: vh'"
+
+  - name: start VM {{ vmid }}
+    sudo: true
+    shell: qm start {{ vmid }}
+    when: "! qm status {{ vmid }} | grep -q running"
+
+verify:
+  - name: VM is running with the intended shape
+    sudo: true
+    shell: |
+      qm status {{ vmid }}
+      qm config {{ vmid }} | grep -E '^(name|cores|cpu|memory|net0|scsi0|ipconfig0|onboot|ciuser):'
+      qm status {{ vmid }} | grep -q running
+    changed_when: "false"

playbooks/nh3-svos-host.yaml

@@ -0,0 +1,80 @@
+# Base build for nh3-svos (VM 111 on nh3-pve-2, 10.100.50.43): the host for the NEW SVOS operating system
+# (corviduo/svoperatingsystem). Requested by svos-dev relaying Prime, 2026-10-05. A SEPARATE instance: the existing
+# High Seat (svos.service on nh3-dev :8770) and Miranda are untouched.
+#   scripts/elway infra-ops@10.100.50.43 --playbook playbooks/nh3-svos-host.yaml
+# Order: nh3-pve-2-cloudinit-vm.yaml (on nh3-pve-2) → bootstrap-infra-ops-user.yaml AS vh → this.
+#
+# Infra owns the box; svos-dev owns the application (install, config, enrollment, acceptance). What this provides:
+# - service account `svc-svos` (uid/gid 801, nologin; fleet-conventions § 1.3), the only writer of the data root
+# - /var/lib/svos   svc-svos 0700, LOCAL ext4 (the root disk on vmstore): SQLite WAL, one writer, never shared/NFS
+# - /opt/svos       root:svc-svos 2775, the release tree (releases/<id>/ + a `current` link; svos-dev lays it out)
+# - Python 3.13 (Debian 13) + venv, sqlite3, qemu-guest-agent (vzdump freeze/thaw), timesyncd checked
+# - /etc/qemu/fsfreeze-hook.d/ exists for the application-consistent snapshot hook svos-dev will add (the guest
+#   agent runs those scripts on vzdump's freeze/thaw)
+# No Docker: nothing here needs it.
+steps:
+  - name: take the bootstrap infra-ops key back off vh (vh keeps the operator's keys)
+    sudo: true
+    shell: |
+      set -e
+      f=/home/vh/.ssh/authorized_keys
+      grep -v 'infra-ops@pfi-fleet' "$f" > "$f.new"
+      test -s "$f.new"
+      chown vh:vh "$f.new"; chmod 600 "$f.new"; mv "$f.new" "$f"
+    when: "sudo -n grep -q 'infra-ops@pfi-fleet' /home/vh/.ssh/authorized_keys"
+
+  - name: timezone America/Los_Angeles
+    sudo: true
+    shell: timedatectl set-timezone America/Los_Angeles
+    when: "[ \"$(timedatectl show -p Timezone --value)\" != America/Los_Angeles ]"
+
+  - name: base packages
+    sudo: true
+    shell: DEBIAN_FRONTEND=noninteractive apt-get install -y -q qemu-guest-agent python3 python3-venv sqlite3 rsync jq curl ca-certificates
+    when: "! dpkg -s qemu-guest-agent python3-venv sqlite3 rsync jq >/dev/null 2>&1"
+
+  - name: qemu-guest-agent running
+    sudo: true
+    shell: systemctl start qemu-guest-agent
+    when: "! systemctl is-active --quiet qemu-guest-agent"
+
+  - name: fsfreeze hook directory for the application-consistent snapshot hook
+    sudo: true
+    shell: install -d -o root -g root -m 0755 /etc/qemu/fsfreeze-hook.d
+    changed_when: "false"
+
+  - name: service account svc-svos (uid/gid 801, nologin, home = the data root)
+    sudo: true
+    shell: |
+      set -e
+      getent group 801 >/dev/null && { echo "gid 801 taken"; exit 1; }
+      getent passwd 801 >/dev/null && { echo "uid 801 taken"; exit 1; }
+      groupadd --system --gid 801 svc-svos
+      useradd --system --uid 801 --gid 801 --shell /usr/sbin/nologin --home-dir /var/lib/svos --no-create-home svc-svos
+    when: "! getent passwd svc-svos >/dev/null"
+
+  - name: data root /var/lib/svos (svc-svos 0700) and release tree /opt/svos (root:svc-svos 2775)
+    sudo: true
+    shell: |
+      install -d -o svc-svos -g svc-svos -m 0700 /var/lib/svos
+      install -d -o root -g svc-svos -m 2775 /opt/svos /opt/svos/releases
+    changed_when: "false"
+
+verify:
+  - name: identities are the fleet pins
+    shell: |
+      test "$(id -u vh)" = 1000 && test "$(id -u infra-ops)" = 850 && test "$(id -u svc-svos)" = 801
+    changed_when: "false"
+  - name: vh no longer carries the infra-ops key
+    sudo: true
+    shell: "! grep -q 'infra-ops@pfi-fleet' /home/vh/.ssh/authorized_keys"
+    changed_when: "false"
+  - name: data root is local ext4 and private
+    sudo: true
+    shell: |
+      test "$(findmnt -T /var/lib/svos -no FSTYPE)" = ext4 && test "$(stat -c '%U %a' /var/lib/svos)" = "svc-svos 700"
+    changed_when: "false"
+  - name: python, sqlite, guest agent, time sync
+    shell: |
+      python3 --version && sqlite3 --version | cut -c1-20 && systemctl is-active qemu-guest-agent && timedatectl show -p NTPSynchronized --value
+    changed_when: "false"

servers/nh3-pve-2/README.md

@@ -13,6 +13,7 @@ possibly a dev environment for security-software work. First guest: nh3-albok (2
 | ID | guest | onboot | notes |
 |---|---|---|---|
 | 110 | **nh3-albok** (`10.100.50.44`, VLAN 50) | 1 | First guest, 2026-10-04 (albok-dev relaying Prime): runs only albok-service. `servers/nh3-albok/README.md` |
+| 111 | **nh3-svos** (`10.100.50.43`, VLAN 50) | 1 | 2026-10-05 (svos-dev relaying Prime): the new SVOS OS. `servers/nh3-svos/README.md` |
 
 VMIDs continue the NH3 numbering (nh3-pve holds 100–109) so a VMID names one guest on the site.
 

servers/nh3-svos/README.md

@@ -0,0 +1,40 @@
+# nh3-svos: host for the NEW SVOS operating system (VM 111 on nh3-pve-2, NH3)
+
+Built 2026-10-05 at svos-dev's request, relaying Prime ("stand up a dedicated VM for it on nh3-pve-2"). It runs the
+new SVOS (repo `corviduo/svoperatingsystem`): a FastAPI/uvicorn kernel (SQLite WAL, synchronous FULL, one writer),
+an interface connector, an optional voice adapter and a static phone/desktop UI.
+**It is a separate instance.** The existing High Seat (`svos.service` on nh3-dev, `:8770`) and Miranda are NOT
+migrated by this host.
+
+**Ownership split:** infra-ops owns the VM, OS, access, backups and ingress. svos-dev owns the application: install,
+configuration, enrollment and acceptance.
+
+| | |
+|---|---|
+| Address | `10.100.50.43`, VLAN 50 (nh3-servers), static via cloud-init; `nh3-svos.nh3.internal` |
+| Guest | VM **111** on **nh3-pve-2**, `onboot 1`, tag `svos` |
+| Shape | 4 vCPU `x86-64-v3`, 8 GiB, 100 GB on `vmstore` (local NVMe LVM-thin, discard on). nh3-pve-2 had 47 GB RAM and 946 GB vmstore free at build |
+| OS | Debian 13 genericcloud, Python 3.13 + venv, SQLite 3.46, systemd-timesyncd (synced), qemu-guest-agent |
+| Identities | `vh` 1000 (operator keys + lkraven@nh3-dev, so svos-dev's session can ssh in; NOPASSWD sudo from cloud-init), `infra-ops` 850, **`svc-svos` 801** (nologin; the only writer of the data root) |
+| Data root | `/var/lib/svos`, svc-svos 0700, on the local root ext4. Never NFS, never shared |
+| Releases | `/opt/svos` root:svc-svos 2775, with `releases/` for svos-dev's layout. The git checkout is not a runtime dependency |
+| Docker | none, by design |
+| Backups | nh3-pve-2 vzdump job, nightly **21:30**, `all 1` → pbs-ana namespace `nh3-pve-2` (mirrored to pbs-nh3 at 06:30), snapshot mode with guest-agent fs-freeze |
+| App-consistent hook | `/etc/qemu/fsfreeze-hook.d/` exists. The guest agent runs those scripts on vzdump's freeze/thaw, which is where svos-dev's SQLite checkpoint hook belongs. Until it lands, backups are crash-consistent (fine for WAL + synchronous FULL, but not the stated requirement) |
+| Monitoring | not yet. Beszel needs the native agent here (no Docker); that is pending together with nh3-albok's |
+
+## Build (reproducible)
+
+```bash
+scripts/elway infra-ops@10.100.250.62 --playbook playbooks/nh3-pve-2-cloudinit-vm.yaml --var vmid=111 \
+  --var name=nh3-svos --var ip=10.100.50.43/24 --var cores=4 --var memory=8192 --var disk=100G --var tags=svos \
+  --var "description=..."
+scripts/elway vh@10.100.50.43        --playbook playbooks/bootstrap-infra-ops-user.yaml
+scripts/elway infra-ops@10.100.50.43 --playbook playbooks/nh3-svos-host.yaml
+```
+
+## Ingress / auth: NOT built yet, proposal pending (Prime + svos-dev)
+
+App listeners stay private (loopback or a Unix socket). The front door has to give the browser **HTTPS**: the UI and the
+voice adapter need a secure context for the microphone. It also has to give the kernel's adapter a **verified identity**
+in `Tailscale-User-Login`, with any browser-supplied copy stripped. See the svos-dev thread of 2026-10-05.

servers/nh3-svos/ssh-target

@@ -0,0 +1 @@
+infra-ops@10.100.50.43

servers/nh3-svos/system-details.txt

@@ -0,0 +1,77 @@
+
+===== HOST =====
+
+Hostname:   nh3-svos.nh3.internal
+Date:       2026-10-05T18:59:30-07:00
+Uptime:     up 1 minute
+OS:         Debian GNU/Linux 13 (trixie)
+Kernel:     6.12.111+deb13-cloud-amd64
+Arch:       x86_64
+
+===== HARDWARE =====
+
+CPU cores:  4
+CPU model:  QEMU Virtual CPU version 2.5+
+MemTotal:   7.8 GB
+MemAvailable: 7.4 GB
+
+===== GPUS =====
+
+nvidia-smi not present (no NVIDIA GPUs or driver not installed)
+
+===== FILESYSTEMS (df) =====
+
+Filesystem      Size  Used Avail Use% Mounted on
+/dev/sda1        99G  862M   94G   1% /
+/dev/sda15      124M  8.9M  115M   8% /boot/efi
+
+===== PERSISTENT MOUNTS (/etc/fstab, non-comment) =====
+
+PARTUUID=fd202e72-0241-4c3b-953d-ffe506ae6cfc / ext4 rw,discard,errors=remount-ro,x-systemd.growfs 0 1
+PARTUUID=b558256e-e822-4787-9bd2-c4c47dfb54d9 /boot/efi vfat defaults,umask=077 0 2
+
+===== TARGETED DATA PATHS =====
+
+/opt  (total: 12K)
+  total 12
+  drwxr-xr-x  3 root root     4096 2026-10-05 18:58 .
+  drwxr-xr-x 18 root root     4096 2026-10-05 18:58 ..
+  drwxrwsr-x  3 root svc-svos 4096 2026-10-05 18:58 svos
+
+/srv  (total: 4.0K)
+  total 8
+  drwxr-xr-x  2 root root 4096 2026-09-30 21:57 .
+  drwxr-xr-x 18 root root 4096 2026-10-05 18:58 ..
+
+
+===== DOCKER =====
+
+docker not installed
+
+===== COMPOSE FILES (/opt/docker/compose/) =====
+
+/opt/docker/compose not present
+
+===== CONFIG LAYOUT (/opt/docker/conf/ — top 200 entries) =====
+
+/opt/docker/conf not present
+
+===== LISTENING PORTS =====
+
+0.0.0.0:22
+0.0.0.0:5355
+127.0.0.53%lo:53
+127.0.0.54:53
+[::]:22
+[::]:5355
+
+===== MODEL / HUGGINGFACE CACHES =====
+
+
+===== DOCKER-ADJACENT SYSTEMD SERVICES =====
+
+(none matching)
+
+===== DONE =====
+
+Paste the above back into the chat, or pass a path as argv[1] to save.

services/sudo-io-archive/hosts

@@ -19,6 +19,7 @@ pfi-gx10        infra-ops@10.100.50.60
 nh3-dev         infra-ops@10.100.10.50
 nh3-docker      infra-ops@10.100.50.40
 nh3-albok       infra-ops@10.100.50.44
+nh3-svos        infra-ops@10.100.50.43
 nh3-extdev      infra-ops@10.100.50.42
 nh3-ml1         infra-ops@10.100.50.80
 esh-docker-vm   infra-ops@10.0.50.45