nh3-pve-2: Minisforum MS-03, Proxmox VE 9 (NH3)

The NH3 MS-03, twin of esh-pve-2. Purpose is TBD on purpose (Prime, 2026-10-02): a high-powered PVE host, possibly a dev environment for security-software work. Standalone node, not clustered with nh3-pve.

Host: 10.100.250.62 on nh3-mgmt (nh3-pve-2.nh3.internal, nh3-pve-2.phasefinal.com in /etc/hosts). Static in /etc/network/interfaces, plus a UDM reservation on 38:05:25:3b:a0:a8. ssh infra-ops@10.100.250.62 (fleet key, NOPASSWD sudo with log_output).
PVE 9.2.21, installed 2026-10-03 on site to the right disk (the 256 GB Toshiba).

NIC	MAC	Chip	Use
`nic0`	`:a6`	I226-LM (igc)	Intel AMT only. UDM port 5, native nh3-mgmt, AMT DHCP `.63`. `auto nic0`, no address, `arp_ignore=8`, IPv6 off (`/etc/sysctl.d/90-amt-port.conf`)
`nic1`	`:a9`	RTL8127 10G	unused
`nic2`	`:a7`	X710 SFP+	unused
`nic3`	`:a8`	X710 SFP+	vmbr0. USW Pro 24 port 25 (native nh3-mgmt, tagged VLANs allowed)

⚠ Keep auto nic0. If Linux leaves the AMT port down, igc powers off the PHY and AMT goes dark. That happened 2026-10-03 when the bridge moved to the SFP+. ⚠ vmbr0 is a plain (not VLAN-aware) bridge. Making it VLAN-aware is a separate change: apply it with a reboot, not a live ifreload. On 2026-10-03 a live ifreload that also re-IP'd read the new vmbr0 as "not a bridge" and downed it (auto-memory feedback_no_remote_reip_thrash_when_operator_has_console).

Disks: boot = Toshiba 256 GB (69CA12VQK65N). VM storage = LVM-thin vmstore, 913 GiB, on the Crucial 1 TB (2610EAD05AB7). It held the old wrong-drive install, which was wiped 2026-10-03 by playbooks/nh3-pve-2-disk-prep.yaml, along with its stale firmware boot entry. Firmware boot order: 0000 proxmox (256 GB), then its fallback 0006. Address disks by /dev/disk/by-id/, because nvme numbering can swap between boots (seen on esh-pve-2).

AMT: MeshCentral device nh3-pve-2-amt (phone-home, AMT 21.0.6, ACM; password vaulted nh3-pve-2/amt-admin). If HW Connect sticks at "Setup…", cira-tunnel-watchdog on pfi-tacticalrmm clears it within ~4 min.