vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

ops: infra-ops identity bootstrapped on all four PVE hypervisors; docs updated

Browse Source
This commit is contained in:
Vuong Hoang
2026-09-05 21:52:40 -07:00
parent 807bf0315a
commit e0759e41a3
4 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/pfi/headscale-mesh-plan.md
+1 -1
View File
@@ -69,7 +69,7 @@ downloaded on any).
| need | have |
|---|---|
| provision LXCs on all three PVEs | `ssh root@` works on pfi-pve, nh3-pve, esh-pve (`infra-ops@` is refused on all three PVE hosts) |
| provision LXCs on all three PVEs | `infra-ops@` with NOPASSWD sudo on all four PVE hosts since 2026-09-06 (elway `bootstrap-infra-ops-user.yaml`; PVE needed `sudo` installed first); `root@` also works |
| public DNS name + DDNS | Cloudflare all-zones DNS-edit token, vault `nh3-dev/.config/cloudflare/infra-ops-dns-token` |
| NH3 UDM port-forward 443 → nh3-headscale; static routes on both UDMs | UDM API keys, vault `unifi/pfi-udmse-api-key`, `unifi/esh-udmpm-api-key` (classic `/rest/*` read+write) |
| colo static route toward ana-mesh-rtr | FortiGate infra-ops SSH pw vaulted; reachable at 10.250.0.1 via the tunnel (`execute backup config` first). Moot once OPNsense lands |
docs/pfi/proxmox-vms.md
+1 -2
View File
@@ -6,8 +6,7 @@ guest-agent IPs. Earlier versions of this file described guests that no longer e
version is the live state._
**Hypervisor:** `pfi-pve` — Dell PowerEdge R750xs, Xeon Silver 4310 (48 threads), 188 GB,
Proxmox VE 8.3.5, `https://10.250.250.31:8006`, `ssh root@10.250.250.31`
(`infra-ops` is refused here). iDRAC `https://10.250.250.30`.
Proxmox VE 8.3.5, `https://10.250.250.31:8006`, `ssh infra-ops@10.250.250.31` (NOPASSWD sudo, since 2026-09-06) or `root@`. iDRAC `https://10.250.250.30`.
**Storage:**
docs/runbooks/pfi-pve-naspool-rebuild.md
+1 -1
View File
@@ -13,7 +13,7 @@ Plan page: http://10.100.10.50:8090/b/pfi-pve-naspool-plan/
## Fixed facts (verified 22:24Z–23:05Z, read-only)
- Host `root@10.250.250.31`, PVE 8.3.5, zfs 2.2.7 (no raidz expansion).
- Host `root@10.250.250.31` (infra-ops user added 2026-09-06 after the rebuild), PVE 8.3.5, zfs 2.2.7 (no raidz expansion).
- Every VM boot disk and CT rootfs is on **ospool** (pbs-ana on local-lvm).
ospool ONLINE, 2 mirrors, 547G used, 10.2T free. **ospool is never
written to by an irreversible command in this runbook.**
playbooks/bootstrap-infra-ops-user.yaml
+4 -1
View File
@@ -20,7 +20,10 @@
# SCOPE — PFI-owned Linux boxes ONLY. NEVER run on:
# - SureFire sf-* / sfsrv-ana (tenant property — coordinate, don't own)
# - corviduo-dev (Worldtree partner app-layer)
# - esh-* (ESH home lab — non-PFI)
# - esh-* app VMs (ESH home lab — non-PFI). EXCEPTION, operator 2026-09-06:
# ALL FOUR PVE HYPERVISORS (pfi-pve, nh3-pve, esh-pve,
# esh-pve-nas) DO get infra-ops — done that day.
# PVE ships without sudo: `apt-get install sudo` first.
# - nh3-nas (Synology DSM) (no standard useradd / sudoers.d)
#
# Idempotent: re-running reconciles the key + sudoers without error.