vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity

ops: infra-ops identity bootstrapped on all four PVE hypervisors; docs updated

Browse Source
This commit is contained in:
vh
2026-09-05 21:52:40 -07:00
parent 807bf0315a
commit e0759e41a3
4 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/pfi/headscale-mesh-plan.md
+1 -1
View File
@@ -69,7 +69,7 @@ downloaded on any).
| need | have |
|---|---|
| provision LXCs on all three PVEs | `ssh root@` works on pfi-pve, nh3-pve, esh-pve (`infra-ops@` is refused on all three PVE hosts) |
| provision LXCs on all three PVEs | `infra-ops@` with NOPASSWD sudo on all four PVE hosts since 2026-09-06 (elway `bootstrap-infra-ops-user.yaml`; PVE needed `sudo` installed first); `root@` also works |
| public DNS name + DDNS | Cloudflare all-zones DNS-edit token, vault `nh3-dev/.config/cloudflare/infra-ops-dns-token` |
| NH3 UDM port-forward 443 → nh3-headscale; static routes on both UDMs | UDM API keys, vault `unifi/pfi-udmse-api-key`, `unifi/esh-udmpm-api-key` (classic `/rest/*` read+write) |
| colo static route toward ana-mesh-rtr | FortiGate infra-ops SSH pw vaulted; reachable at 10.250.0.1 via the tunnel (`execute backup config` first). Moot once OPNsense lands |