esh-pfi-infrastructure/playbooks/nh3-albok-vm.yaml

# Create VM 110 `nh3-albok` on nh3-pve-2: the dedicated albok-service host (2026-10-04).
#   scripts/elway infra-ops@10.100.250.62 --playbook playbooks/nh3-albok-vm.yaml
# Needs vmbr0 VLAN-aware first (playbooks/nh3-pve-2-vmbr0-vlan-aware.yaml + a reboot).
#
# Why a VM of its own (albok-dev, relaying Prime 2026-10-04 ~2235): on nh3-docker the store shared a
# host with three containers holding the docker socket read-write (portainer, portainer_agent, dockge)
# plus dockerd on plaintext tcp/2375 for Homepage. Each of those is root over /srv/albok, and unit 4
# puts the operator's personal vault and licensed books into restricted wings. Also memory: albok sat
# at 2.4 of a 4 GiB cap on a 7.7 GiB host it shared with the post office and AdGuard.
#
# Shape: Debian 13 genericcloud + cloud-init. 4 vCPU (x86-64-v3: AVX2 for the index code, and still
# restorable on nh3-pve's i9-13900H), 12 GiB, 100 GB on `vmstore`, VLAN 50 (nh3-servers) at
# 10.100.50.44 — below the UDM's DHCP pool (.150–.249), like every other static on that VLAN.
# VMID 110 continues the NH3 numbering (nh3-pve holds 100–109) so "VM 110" is unambiguous on the site;
# PBS keeps nodes apart by namespace anyway.
#
# cloud-init creates `vh` (uid 1000, the fleet's human account) with NOPASSWD sudo. infra-ops (uid 850)
# is then built by playbooks/bootstrap-infra-ops-user.yaml run AS vh, after which the infra-ops key is
# taken back off vh (playbooks/nh3-albok-host.yaml).
vars:
  vmid: "110"
  name: nh3-albok
  ip: 10.100.50.44/24
  gw: 10.100.50.1
  # nh3-docker AdGuard first, ana-docker AdGuard second: the same pair the UDM hands out on VLAN 50
  dns: 10.100.50.40 10.250.50.70
  img_url: https://cloud.debian.org/images/cloud/trixie/latest
  img: debian-13-genericcloud-amd64.qcow2
  img_dir: /var/lib/vz/import

steps:
  - name: refuse unless this is nh3-pve-2, vmbr0 is VLAN-aware, and the VMID and address are free
    sudo: true
    shell: |
      set -e
      test "$(hostname)" = nh3-pve-2
      test "$(cat /sys/class/net/vmbr0/bridge/vlan_filtering)" = 1
      if ping -c2 -W1 $(echo {{ ip }} | cut -d/ -f1) >/dev/null 2>&1; then echo "{{ ip }} ANSWERS — taken"; exit 1; fi
    changed_when: "false"
    when: "! qm status {{ vmid }} >/dev/null 2>&1"

  - name: fetch the Debian 13 genericcloud image and check it against SHA512SUMS
    sudo: true
    shell: |
      set -e
      install -d -m 0755 {{ img_dir }}
      cd {{ img_dir }}
      curl -fsSL -o SHA512SUMS.trixie {{ img_url }}/SHA512SUMS
      curl -fsSL -o {{ img }}.part {{ img_url }}/{{ img }}
      want=$(awk '$2=="{{ img }}"{print $1}' SHA512SUMS.trixie)
      test -n "$want"
      echo "$want  {{ img }}.part" | sha512sum -c -
      mv {{ img }}.part {{ img }}
    when: "! qm status {{ vmid }} >/dev/null 2>&1"

  - name: create VM {{ vmid }} ({{ name }})
    sudo: true
    shell: |
      set -e
      qm create {{ vmid }} --name {{ name }} --ostype l26 --cpu x86-64-v3 --cores 4 --memory 12288 \
        --scsihw virtio-scsi-single --agent enabled=1 --onboot 1 --tags albok \
        --net0 virtio,bridge=vmbr0,tag=50,firewall=1 \
        --serial0 socket --vga serial0 \
        --description "albok-service host (fleet knowledgebase). Runs ONLY albok-service. Built 2026-10-04, eshpfi playbooks/nh3-albok-vm.yaml + nh3-albok-host.yaml; servers/nh3-albok/README.md"
      qm set {{ vmid }} --scsi0 vmstore:0,import-from={{ img_dir }}/{{ img }},discard=on,ssd=1,iothread=1
      qm disk resize {{ vmid }} scsi0 100G
      qm set {{ vmid }} --ide2 vmstore:cloudinit --boot order=scsi0
    creates: /etc/pve/qemu-server/{{ vmid }}.conf

  - name: cloud-init — user vh, keys, static address, resolvers
    sudo: true
    shell: |
      set -e
      k=$(mktemp)
      cat > "$k" <<'EOF'
      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIN+1HBwfXrkfTYWdcnWCjLJ6VLAGC87gxH5h5vKaaA3c infra-ops@pfi-fleet
      ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKGm/lJslGEL2xDBY/7LdUc0Q4GyuxwFtGspYTe6WsVE lkrav@VHHomeG13
      ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDP/AwgaLghPoQi9RDt+m/9H9jLHDoP93WgzczlhZlSvZoQ5qDpWu5oAQlRwImiWhVL1ClK4FwEz9JULsta7Uq3FaiQvs2ltevrW/EpNbhAfxZa4Z1ELrPAOO8SSlhZ+Zer33SPkfJD9t3Hi9TXheCaANiEtE6hH1nCVLpHWQdbzy+L7EyG8z+/RzNXwwIL8f0BZ8n7FvFujgwc1OQTXlg4fiW3FdB3uzJMVRT59IIsPEq/ODGZZ6XGtHy24Ewcsi8l78I+oKaPdMl8ZXNBQrNb0MPIJnHkQwTrzlDKZ0Oh1UKm7I9i9hDMB/M2+aQ+6MxzY5TLZyDvRYd8R3j9Mnrp3ouCnNcklGAkX7i8hNJ2y8xCbwOeP8sMd+VtQ6hBbNa6KAEaAgGuWHHS0KGGO4HjtvDxJH8e7BnGzveIeCUGLVKMrg08w9nqF6Kzf3Y72ou0yCmnu7kKqocS1Pcr+e5E1MdT4brc2BfYkzqExLp8gxQaJ1Zas2OXPNXpAxL58xc= lkraven@nh3-dev
      EOF
      sed -i 's/^ *//' "$k"
      qm set {{ vmid }} --ciuser vh --sshkeys "$k" --ipconfig0 ip={{ ip }},gw={{ gw }} \
        --nameserver "{{ dns }}" --searchdomain nh3.internal --ciupgrade 1
      rm -f "$k"
    when: "! qm config {{ vmid }} | grep -q '^ciuser: vh'"

  - name: start VM {{ vmid }}
    sudo: true
    shell: qm start {{ vmid }}
    when: "! qm status {{ vmid }} | grep -q running"

verify:
  - name: VM is running with the intended shape
    sudo: true
    shell: |
      qm status {{ vmid }}
      qm config {{ vmid }} | grep -E '^(name|cores|cpu|memory|net0|scsi0|ipconfig0|onboot|ciuser):'
      qm status {{ vmid }} | grep -q running
    changed_when: "false"