Files

T

vh 017f8f9b76 fleet: re-frame SureFire hosts from tenant-only to PFI-managed

Initial framing was wrong. PFI runs these under a managed-hosting
agreement: SSH, OS ops, backups are all PFI's responsibility. Hardware
and data belong to the client.

Changes:
- ssh-target files added for sfsrv-ana (root@10.250.250.115 — same
  pattern as other PVE nodes) and sf-ana-container
  (lkraven@10.250.150.100 guess, adjust if different user).
- sf-r630 still lacks an ssh-target — the OS-side LAN IP isn't in
  FortiGate DHCP (static config somewhere). Will fill in once
  identified; README flags that gap.
- READMEs rewritten: dropped "tenant-scoped" / "not SSH-managed"
  language, added "client context" section that explains the
  managed-hosting relationship. Backup coverage now listed as
  planned rather than blocked on tenant coordination.
- CLAUDE.md fleet table: SF rows re-labeled "SureFire client
  (PFI-managed)". Placement-rules section updated to note that
  SF hosts are first-class PFI-ops targets, just client-owned.
- Memory (project_surefire_tenant.md) rewritten to reflect
  managed-services reality + hosts-file entries needed for name
  resolution since these aren't in PFI DNS.

2026-04-21 16:51:50 -07:00

1.6 KiB

Raw Blame History

sfsrv-ana

SureFire-client Proxmox hypervisor at the Anaheim colo. Client-owned equipment but PFI-managed under the hosting agreement — we have SSH and are responsible for operations.

Client context

Client: SureFire (SF prefix is SF-client hosts)
PFI role: full-service managed host (rack, power, network, OS ops, backups)

Network

LAN IP: 10.250.250.115
FQDN: not yet in DNS / /etc/hosts — add a line to the workstation's hosts file to make short-name resolution work:
```
10.250.250.115  sfsrv-ana
```
Web UI: https://10.250.250.115:8006 (Proxmox VE)
SSH: root@10.250.250.115 (key auth — same pattern as other PVE nodes)

Infrastructure

Type: Proxmox VE hypervisor (bare metal)
Site: Anaheim (PFI colo)

Hosts SureFire's VMs, including:

sf-ana-container (10.250.150.100) on the dedicated SF container subnet

Backup coverage

VM-image: status unknown — probe with scripts/refresh-proxmox-info.sh sfsrv-ana once SSH is verified. If no vzdump jobs are configured, set them up the same as pfi-pve (daily 01:00 into a network target).
File-level restic: not yet configured.

This is on the open work list — once we've validated SSH + refreshed the Proxmox snapshot, add a configs/restic/sfsrv-ana/ profile if it's running hosted workloads whose state we care about beyond the VM-image layer.

Refresh state

scripts/refresh-proxmox-info.sh sfsrv-ana

Discovered via

scripts/discover-fortigate.sh 10.250.250.1 on 2026-04-21 (MAC 44:a8:42:33:d9:c3).

1.6 KiB Raw Blame History