From e0759e41a3d2feee280fc2feebb9d7eb963c2884 Mon Sep 17 00:00:00 2001 From: Vuong Hoang Date: Sat, 5 Sep 2026 21:52:40 -0700 Subject: [PATCH] ops: infra-ops identity bootstrapped on all four PVE hypervisors; docs updated --- docs/pfi/headscale-mesh-plan.md | 2 +- docs/pfi/proxmox-vms.md | 3 +-- docs/runbooks/pfi-pve-naspool-rebuild.md | 2 +- playbooks/bootstrap-infra-ops-user.yaml | 5 ++++- 4 files changed, 7 insertions(+), 5 deletions(-) diff --git a/docs/pfi/headscale-mesh-plan.md b/docs/pfi/headscale-mesh-plan.md index c872376..06711f2 100644 --- a/docs/pfi/headscale-mesh-plan.md +++ b/docs/pfi/headscale-mesh-plan.md @@ -69,7 +69,7 @@ downloaded on any). | need | have | |---|---| -| provision LXCs on all three PVEs | `ssh root@` works on pfi-pve, nh3-pve, esh-pve (`infra-ops@` is refused on all three PVE hosts) | +| provision LXCs on all three PVEs | `infra-ops@` with NOPASSWD sudo on all four PVE hosts since 2026-09-06 (elway `bootstrap-infra-ops-user.yaml`; PVE needed `sudo` installed first); `root@` also works | | public DNS name + DDNS | Cloudflare all-zones DNS-edit token, vault `nh3-dev/.config/cloudflare/infra-ops-dns-token` | | NH3 UDM port-forward 443 → nh3-headscale; static routes on both UDMs | UDM API keys, vault `unifi/pfi-udmse-api-key`, `unifi/esh-udmpm-api-key` (classic `/rest/*` read+write) | | colo static route toward ana-mesh-rtr | FortiGate infra-ops SSH pw vaulted; reachable at 10.250.0.1 via the tunnel (`execute backup config` first). Moot once OPNsense lands | diff --git a/docs/pfi/proxmox-vms.md b/docs/pfi/proxmox-vms.md index cf8df6a..e57e199 100644 --- a/docs/pfi/proxmox-vms.md +++ b/docs/pfi/proxmox-vms.md @@ -6,8 +6,7 @@ guest-agent IPs. Earlier versions of this file described guests that no longer e version is the live state._ **Hypervisor:** `pfi-pve` — Dell PowerEdge R750xs, Xeon Silver 4310 (48 threads), 188 GB, -Proxmox VE 8.3.5, `https://10.250.250.31:8006`, `ssh root@10.250.250.31` -(`infra-ops` is refused here). iDRAC `https://10.250.250.30`. +Proxmox VE 8.3.5, `https://10.250.250.31:8006`, `ssh infra-ops@10.250.250.31` (NOPASSWD sudo, since 2026-09-06) or `root@`. iDRAC `https://10.250.250.30`. **Storage:** diff --git a/docs/runbooks/pfi-pve-naspool-rebuild.md b/docs/runbooks/pfi-pve-naspool-rebuild.md index e72801b..ec2a925 100644 --- a/docs/runbooks/pfi-pve-naspool-rebuild.md +++ b/docs/runbooks/pfi-pve-naspool-rebuild.md @@ -13,7 +13,7 @@ Plan page: http://10.100.10.50:8090/b/pfi-pve-naspool-plan/ ## Fixed facts (verified 22:24Z–23:05Z, read-only) -- Host `root@10.250.250.31`, PVE 8.3.5, zfs 2.2.7 (no raidz expansion). +- Host `root@10.250.250.31` (infra-ops user added 2026-09-06 after the rebuild), PVE 8.3.5, zfs 2.2.7 (no raidz expansion). - Every VM boot disk and CT rootfs is on **ospool** (pbs-ana on local-lvm). ospool ONLINE, 2 mirrors, 547G used, 10.2T free. **ospool is never written to by an irreversible command in this runbook.** diff --git a/playbooks/bootstrap-infra-ops-user.yaml b/playbooks/bootstrap-infra-ops-user.yaml index 6f2a239..d4b50dc 100644 --- a/playbooks/bootstrap-infra-ops-user.yaml +++ b/playbooks/bootstrap-infra-ops-user.yaml @@ -20,7 +20,10 @@ # SCOPE — PFI-owned Linux boxes ONLY. NEVER run on: # - SureFire sf-* / sfsrv-ana (tenant property — coordinate, don't own) # - corviduo-dev (Worldtree partner app-layer) -# - esh-* (ESH home lab — non-PFI) +# - esh-* app VMs (ESH home lab — non-PFI). EXCEPTION, operator 2026-09-06: +# ALL FOUR PVE HYPERVISORS (pfi-pve, nh3-pve, esh-pve, +# esh-pve-nas) DO get infra-ops — done that day. +# PVE ships without sudo: `apt-get install sudo` first. # - nh3-nas (Synology DSM) (no standard useradd / sudoers.d) # # Idempotent: re-running reconciles the key + sudoers without error.