vh
017f8f9b76
Initial framing was wrong. PFI runs these under a managed-hosting agreement: SSH, OS ops, backups are all PFI's responsibility. Hardware and data belong to the client. Changes: - ssh-target files added for sfsrv-ana (root@10.250.250.115 — same pattern as other PVE nodes) and sf-ana-container (lkraven@10.250.150.100 guess, adjust if different user). - sf-r630 still lacks an ssh-target — the OS-side LAN IP isn't in FortiGate DHCP (static config somewhere). Will fill in once identified; README flags that gap. - READMEs rewritten: dropped "tenant-scoped" / "not SSH-managed" language, added "client context" section that explains the managed-hosting relationship. Backup coverage now listed as planned rather than blocked on tenant coordination. - CLAUDE.md fleet table: SF rows re-labeled "SureFire client (PFI-managed)". Placement-rules section updated to note that SF hosts are first-class PFI-ops targets, just client-owned. - Memory (project_surefire_tenant.md) rewritten to reflect managed-services reality + hosts-file entries needed for name resolution since these aren't in PFI DNS.
55 lines
1.6 KiB
Markdown
55 lines
1.6 KiB
Markdown
# sfsrv-ana
|
|
|
|
SureFire-client Proxmox hypervisor at the Anaheim colo. Client-owned
|
|
equipment but **PFI-managed** under the hosting agreement — we have SSH
|
|
and are responsible for operations.
|
|
|
|
## Client context
|
|
|
|
- **Client:** SureFire (SF prefix is SF-client hosts)
|
|
- **PFI role:** full-service managed host (rack, power, network, OS
|
|
ops, backups)
|
|
|
|
## Network
|
|
|
|
- **LAN IP:** 10.250.250.115
|
|
- **FQDN:** not yet in DNS / `/etc/hosts` — add a line to the
|
|
workstation's hosts file to make short-name resolution work:
|
|
```
|
|
10.250.250.115 sfsrv-ana
|
|
```
|
|
- **Web UI:** https://10.250.250.115:8006 (Proxmox VE)
|
|
- **SSH:** `root@10.250.250.115` (key auth — same pattern as other PVE nodes)
|
|
|
|
## Infrastructure
|
|
|
|
- **Type:** Proxmox VE hypervisor (bare metal)
|
|
- **Site:** Anaheim (PFI colo)
|
|
|
|
Hosts SureFire's VMs, including:
|
|
- `sf-ana-container` (10.250.150.100) on the dedicated SF container subnet
|
|
|
|
## Backup coverage
|
|
|
|
- **VM-image:** status unknown — probe with
|
|
`scripts/refresh-proxmox-info.sh sfsrv-ana` once SSH is verified.
|
|
If no vzdump jobs are configured, set them up the same as pfi-pve
|
|
(daily 01:00 into a network target).
|
|
- **File-level restic:** not yet configured.
|
|
|
|
This is on the open work list — once we've validated SSH + refreshed
|
|
the Proxmox snapshot, add a `configs/restic/sfsrv-ana/` profile if
|
|
it's running hosted workloads whose state we care about beyond the
|
|
VM-image layer.
|
|
|
|
## Refresh state
|
|
|
|
```bash
|
|
scripts/refresh-proxmox-info.sh sfsrv-ana
|
|
```
|
|
|
|
## Discovered via
|
|
|
|
`scripts/discover-fortigate.sh 10.250.250.1` on 2026-04-21 (MAC
|
|
`44:a8:42:33:d9:c3`).
|