vh
d3f59aa2c5
albok-service leaves nh3-docker before unit 4 puts the personal vault and licensed books into restricted wings. On nh3-docker, portainer, portainer_agent, dockge (socket rw) and dockerd on plaintext tcp/2375 were each root over /srv/albok. The new host runs only albok-service: no socket containers and no TCP Docker API, so its Homepage tile is a static services.yaml entry. - nh3-pve-2: vmbr0 made VLAN-aware (applied by reboot, no guests running); pbs-ana storage in the new namespace nh3-pve-2, plus a 21:30 vzdump job (pbs-nh3's recursive sync mirrors it) - VM 110 nh3-albok, 10.100.50.44 on VLAN 50, Debian 13 cloud-init, 4 vCPU x86-64-v3 / 12 GiB / 100 GB; built to fleet conventions (vh 1000, infra-ops 850, docker 851) - compose: mem_limit 4g -> 8g, homepage labels removed; host port 8392 kept - cutover by tar stream, verified by digest (contents plus owner, group, mode, mtime and type identical); albok.nh3.internal now points at nh3-albok - old /srv/albok stays on nh3-docker (container removed, compose renamed) until acceptance and the operator's approval to delete it - sudo-io archive hosts and ops-log STACK_HOSTS include nh3-albok
46 lines
2.3 KiB
YAML
46 lines
2.3 KiB
YAML
# Host preparation for albok-service (2026-10-02; nh3-docker, then nh3-albok from 2026-10-04). Idempotent.
|
|
# scripts/elway infra-ops@10.100.50.44 --playbook playbooks/albok-service-host.yaml
|
|
# Creates the service identity and read groups with FIXED numeric ids (the contract requires them),
|
|
# and the two local roots owned by uid 1500. The config file itself (it carries the embedder key)
|
|
# is uploaded separately to /srv/albok/etc/albok.yaml: see stacks/albok-service/README.md.
|
|
steps:
|
|
- name: group albok (gid 1500)
|
|
sudo: true
|
|
shell: groupadd --gid 1500 albok
|
|
when: "! getent group albok >/dev/null"
|
|
- name: user albok (uid 1500, no login, no home)
|
|
sudo: true
|
|
shell: useradd --system --uid 1500 --gid 1500 --no-create-home --home-dir /nonexistent --shell /usr/sbin/nologin albok
|
|
when: "! getent passwd albok >/dev/null"
|
|
- name: read group albok-read (gid 1510) — building `fleet`
|
|
sudo: true
|
|
shell: groupadd --gid 1510 albok-read
|
|
when: "! getent group albok-read >/dev/null"
|
|
- name: read group albok-personal (gid 1511) — building `personal`
|
|
sudo: true
|
|
shell: groupadd --gid 1511 albok-personal
|
|
when: "! getent group albok-personal >/dev/null"
|
|
- name: read group albok-feedback (gid 1512) — restricted wing personal/agent-feedback
|
|
sudo: true
|
|
shell: groupadd --gid 1512 albok-feedback
|
|
when: "! getent group albok-feedback >/dev/null"
|
|
- name: store root, private root and config dir (local ext4, never NFS)
|
|
sudo: true
|
|
shell: |
|
|
set -e
|
|
install -d -o 1500 -g 1500 -m 0711 /srv/albok/store
|
|
install -d -o 1500 -g 1500 -m 0700 /srv/albok/private
|
|
install -d -o root -g 1500 -m 0750 /srv/albok/etc
|
|
changed_when: "false"
|
|
|
|
verify:
|
|
- name: ids are the fixed numbers
|
|
shell: |
|
|
test "$(getent passwd albok | cut -d: -f3,4)" = "1500:1500" && test "$(getent group albok-read | cut -d: -f3)" = 1510 && test "$(getent group albok-personal | cut -d: -f3)" = 1511 && test "$(getent group albok-feedback | cut -d: -f3)" = 1512
|
|
changed_when: "false"
|
|
- name: roots are local (not NFS) and owned by 1500
|
|
sudo: true
|
|
shell: |
|
|
test "$(findmnt -T /srv/albok/store -no FSTYPE)" = ext4 && test "$(stat -c %u /srv/albok/store)" = 1500 && test "$(stat -c %u /srv/albok/private)" = 1500
|
|
changed_when: "false"
|