# Priority 2 — verified 2026-09-11

Four native unprivileged Beszel 0.18.7 agents installed, active, boot-enabled,
and reporting fresh hub samples at 2026-09-12 01:56Z:

| Host | Address | Filesystems | Root usage |
|---|---|---|---|
| pfi-postgres | 10.250.50.80 | root (local database storage) | 6.31% |
| esh-vm-db | 10.0.50.60 | root, /mnt/backup | 2.22% |
| pbs-ana | 10.250.50.90 | root, /mnt/pbs-datastore | 10.43% |
| pbs-nh3 | 10.100.50.90 | root, /mnt/pbs-datastore | 7.32% |

PBS-ANA datastore filesystem: 1426.62/21749.13 GiB (~6.6%).
PBS-NH3 datastore filesystem: 32365.07/42879.36 GiB (~75.5%). These measure
the exported filesystem's capacity, not bytes belonging exclusively to PBS.
NFS provides capacity, not local block-device I/O counters.

Each has Disk >85%/5m, CPU >95%/15m, Memory >90%/10m and offline/2m:
16 new rules read back successfully. Existing operator-user infra-ops bridge
route retained. No notification destination changes or induced alert test.
Fleet readback: 18 registered, 17 up; only known ana-ml2 outage remains.
PostgreSQL accepts connections on both DB hosts; MongoDB running on ESH;
both PBS API and proxy services running. No DB/PBS/VM restarts performed.
Resource monitoring does NOT verify backup/sync-job success or DB query health.

## Administrative path

esh-vm-db uses infra-ops NOPASSWD sudo with playbooks/beszel-native.yaml.
Other three allow documented lkraven SSH but require sudo password; no matching
vault item found. Existing Proxmox guest-agent admin execution was verified and
used instead, WITHOUT changing accounts, sudoers or SSH settings:

| VM | Hypervisor | VMID |
|---|---|---|
| pfi-postgres | pfi-pve (10.250.250.31) | 105 |
| pbs-ana | pfi-pve (10.250.250.31) | 100 |
| pbs-nh3 | nh3-pve (10.100.250.60) | 105 |

First run `playbooks/beszel-guest-stage.yaml` against the guest's SSH alias with
`env_file=configs/beszel-agent/hosts/<name>.env`; then run
`playbooks/beszel-guest-install.yaml` against infra-ops@hypervisor with `vmid`.
Always verify host/VMID mapping first (IDs overlap across hypervisors).
Uses the previously checksum-verified binary in /tmp/beszel-priority1/;
see README.md for download/checksum. Stage files contain public key only.
Install script preserves existing application services and only restarts Beszel.
Hub registration/alert creation is separate from these deployment playbooks.
Changes saved locally, not committed, per outstanding main-branch approval.