vh
a841eab3ff
NH3 manager/external-dev box at 10.100.50.42 (Debian 13 VM on nh3-pve),
successor to the retired nh3-ansible. infra-ops identity here is sudo-LESS
by operator decision (2026-06-17): key-only, no NOPASSWD, not in docker
group — user-level management only. Adds servers/nh3-extdev/{README,
ssh-target,system-details.txt}, the CLAUDE.md inventory row, and a local
ssh alias (nh3-extdev -> infra-ops@10.100.50.42, infra-ops key). Login +
sudo-less posture verified.
nh3-extdev
NH3-site manager / external-dev box — 10.100.50.42. Fresh Debian 13
(trixie) VM on nh3-pve (QEMU: 8 vCPU / 7.8 GB / 250 GB, no GPU). Successor to
the retired nh3-ansible. Not a Docker-stack host (Docker not installed).
Reach: the dedicated agent identity only —
ssh nh3-extdev (alias) = ssh -i ~/.ssh/infra-ops_ed25519 infra-ops@10.100.50.42.
The infra-ops user here is sudo-LESS by design (operator decision
2026-06-17): key-only login, password locked, no NOPASSWD sudo, not in the
docker group — deliberately tighter than the rest of the fleet's infra-ops
identity ([reference_infra_ops_sudo_identity] in auto-memory, which is the
sudo variant). Management here is user-level only: files/repos/tooling under
the home dir, systemctl --user, world-readable system state. No root ops (apt,
system services, /etc, root-owned files) and no Docker unless a later,
explicit grant is made (command-scoped sudoers preferred over docker-group, which
is root-equivalent).
Purpose
NH3 manager / external-dev box; role being established (2026-06-17). Successor to
the retired nh3-ansible.
Notes
- Debian 13 (trixie) — newer than the fleet's Debian-12 baseline; watch for package/behaviour drift vs other hosts.
sudowarnsunable to resolve host nh3-extdev(hostname not in/etc/hosts) — cosmetic; add127.0.1.1 nh3-extdevto/etc/hosts(needs root) to silence.- Stood up 2026-06-17; first
system-details.txtcaptured the same day (sudo-less, so docker/root-only sections are necessarily blank).