vh/esh-pfi-infrastructure
1
0
Fork 0
Code Issues 7 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
cd3c4b8be99fcca621fba4159e1d6a9e70fd4557
esh-pfi-infrastructure/servers/nh3-albok/system-details.txt
T
vh d3f59aa2c5 feat(albok): move albok-service to a dedicated VM, nh3-albok (VM 110 on nh3-pve-2) 
albok-service leaves nh3-docker before unit 4 puts the personal vault and
licensed books into restricted wings. On nh3-docker, portainer, portainer_agent,
dockge (socket rw) and dockerd on plaintext tcp/2375 were each root over
/srv/albok. The new host runs only albok-service: no socket containers and no
TCP Docker API, so its Homepage tile is a static services.yaml entry.

- nh3-pve-2: vmbr0 made VLAN-aware (applied by reboot, no guests running);
  pbs-ana storage in the new namespace nh3-pve-2, plus a 21:30 vzdump job
  (pbs-nh3's recursive sync mirrors it)
- VM 110 nh3-albok, 10.100.50.44 on VLAN 50, Debian 13 cloud-init, 4 vCPU
  x86-64-v3 / 12 GiB / 100 GB; built to fleet conventions (vh 1000,
  infra-ops 850, docker 851)
- compose: mem_limit 4g -> 8g, homepage labels removed; host port 8392 kept
- cutover by tar stream, verified by digest (contents plus owner, group, mode,
  mtime and type identical); albok.nh3.internal now points at nh3-albok
- old /srv/albok stays on nh3-docker (container removed, compose renamed)
  until acceptance and the operator's approval to delete it
- sudo-io archive hosts and ops-log STACK_HOSTS include nh3-albok
2026-10-04 23:33:24 -07:00

190 lines
13 KiB
Plaintext
Raw Blame History

===== HOST =====
Hostname: nh3-albok.nh3.internal
Date: 2026-10-04T23:32:32-07:00
Uptime: up 19 minutes
OS: Debian GNU/Linux 13 (trixie)
Kernel: 6.12.111+deb13-cloud-amd64
Arch: x86_64
===== HARDWARE =====
CPU cores: 4
CPU model: QEMU Virtual CPU version 2.5+
MemTotal: 11.7 GB
MemAvailable: 10.6 GB
===== GPUS =====
nvidia-smi not present (no NVIDIA GPUs or driver not installed)
===== FILESYSTEMS (df) =====
Filesystem Size Used Avail Use% Mounted on
/dev/sda1 99G 4.8G 90G 6% /
/dev/sda15 124M 8.9M 115M 8% /boot/efi
===== PERSISTENT MOUNTS (/etc/fstab, non-comment) =====
PARTUUID=fd202e72-0241-4c3b-953d-ffe506ae6cfc / ext4 rw,discard,errors=remount-ro,x-systemd.growfs 0 1
PARTUUID=b558256e-e822-4787-9bd2-c4c47dfb54d9 /boot/efi vfat defaults,umask=077 0 2
===== TARGETED DATA PATHS =====
/opt (total: 48K)
total 16
drwxr-xr-x 4 root root 4096 2026-10-04 23:15 .
drwxr-xr-x 18 root root 4096 2026-10-04 23:13 ..
drwx--x--x 4 root root 4096 2026-10-04 23:15 containerd
drwxrwsr-x 4 root docker 4096 2026-10-04 23:15 docker
/opt/docker (total: 40K)
total 16
drwxrwsr-x 4 root docker 4096 2026-10-04 23:15 .
drwxr-xr-x 4 root root 4096 2026-10-04 23:15 ..
drwxrwsr-x 3 root docker 4096 2026-10-04 23:16 compose
drwxrwsr-x 3 root docker 4096 2026-10-04 23:16 conf
/opt/docker/compose (total: 20K)
total 12
drwxrwsr-x 3 root docker 4096 2026-10-04 23:16 .
drwxrwsr-x 4 root docker 4096 2026-10-04 23:15 ..
drwxrwsr-x 2 infra-ops docker 4096 2026-10-04 23:16 albok-service
/opt/docker/conf (total: 16K)
total 12
drwxrwsr-x 3 root docker 4096 2026-10-04 23:16 .
drwxrwsr-x 4 root docker 4096 2026-10-04 23:15 ..
drwxrwsr-x 2 infra-ops docker 4096 2026-10-04 23:16 albok-service
/var/lib/docker (total: 4.0K)
/srv (total: 20K)
total 12
drwxr-xr-x 3 root root 4096 2026-10-04 23:15 .
drwxr-xr-x 18 root root 4096 2026-10-04 23:13 ..
drwxr-xr-x 5 root root 4096 2026-10-04 23:15 albok
===== DOCKER =====
Server: 29.8.2 Client: 29.8.2
----- docker info -----
Containers: 1 (running 1, paused 0, stopped 0)
Images: 1
Runtimes: map[io.containerd.runc.v2:{{runc [] map[]} map[org.opencontainers.runtime-spec.features:{"ociVersionMin":"1.0.0","ociVersionMax":"1.3.0","hooks":["prestart","createRuntime","createContainer","startContainer","poststart","poststop"],"mountOptions":["async","atime","bind","defaults","dev","diratime","dirsync","exec","iversion","lazytime","loud","mand","noatime","nodev","nodiratime","noexec","noiversion","nolazytime","nomand","norelatime","nostrictatime","nosuid","nosymfollow","private","ratime","rbind","rdev","rdiratime","relatime","remount","rexec","rnoatime","rnodev","rnodiratime","rnoexec","rnorelatime","rnostrictatime","rnosuid","rnosymfollow","ro","rprivate","rrelatime","rro","rrw","rshared","rslave","rstrictatime","rsuid","rsymfollow","runbindable","rw","shared","silent","slave","strictatime","suid","symfollow","sync","tmpcopyup","unbindable"],"linux":{"namespaces":["cgroup","ipc","mount","network","pid","time","user","uts"],"capabilities":["CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_DAC_READ_SEARCH","CAP_FOWNER","CAP_FSETID","CAP_KILL","CAP_SETGID","CAP_SETUID","CAP_SETPCAP","CAP_LINUX_IMMUTABLE","CAP_NET_BIND_SERVICE","CAP_NET_BROADCAST","CAP_NET_ADMIN","CAP_NET_RAW","CAP_IPC_LOCK","CAP_IPC_OWNER","CAP_SYS_MODULE","CAP_SYS_RAWIO","CAP_SYS_CHROOT","CAP_SYS_PTRACE","CAP_SYS_PACCT","CAP_SYS_ADMIN","CAP_SYS_BOOT","CAP_SYS_NICE","CAP_SYS_RESOURCE","CAP_SYS_TIME","CAP_SYS_TTY_CONFIG","CAP_MKNOD","CAP_LEASE","CAP_AUDIT_WRITE","CAP_AUDIT_CONTROL","CAP_SETFCAP","CAP_MAC_OVERRIDE","CAP_MAC_ADMIN","CAP_SYSLOG","CAP_WAKE_ALARM","CAP_BLOCK_SUSPEND","CAP_AUDIT_READ","CAP_PERFMON","CAP_BPF","CAP_CHECKPOINT_RESTORE"],"cgroup":{"v1":true,"v2":true,"systemd":true,"systemdUser":true,"rdma":true},"seccomp":{"enabled":true,"actions":["SCMP_ACT_ALLOW","SCMP_ACT_ERRNO","SCMP_ACT_KILL","SCMP_ACT_KILL_PROCESS","SCMP_ACT_KILL_THREAD","SCMP_ACT_LOG","SCMP_ACT_NOTIFY","SCMP_ACT_TRACE","SCMP_ACT_TRAP"],"operators":["SCMP_CMP_EQ","SCMP_CMP_GE","SCMP_CMP_GT","SCMP_CMP_LE","SCMP_CMP_LT","SCMP_CMP_MASKED_EQ","SCMP_CMP_NE"],"archs":["SCMP_ARCH_AARCH64","SCMP_ARCH_ARM","SCMP_ARCH_LOONGARCH64","SCMP_ARCH_MIPS","SCMP_ARCH_MIPS64","SCMP_ARCH_MIPS64N32","SCMP_ARCH_MIPSEL","SCMP_ARCH_MIPSEL64","SCMP_ARCH_MIPSEL64N32","SCMP_ARCH_PPC","SCMP_ARCH_PPC64","SCMP_ARCH_PPC64LE","SCMP_ARCH_RISCV64","SCMP_ARCH_S390","SCMP_ARCH_S390X","SCMP_ARCH_X32","SCMP_ARCH_X86","SCMP_ARCH_X86_64"],"knownFlags":["SECCOMP_FILTER_FLAG_TSYNC","SECCOMP_FILTER_FLAG_SPEC_ALLOW","SECCOMP_FILTER_FLAG_LOG","SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV"],"supportedFlags":["SECCOMP_FILTER_FLAG_TSYNC","SECCOMP_FILTER_FLAG_SPEC_ALLOW","SECCOMP_FILTER_FLAG_LOG","SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV"]},"apparmor":{"enabled":true},"selinux":{"enabled":true},"intelRdt":{"enabled":true,"schemata":true,"monitoring":true},"memoryPolicy":{"modes":["MPOL_BIND","MPOL_DEFAULT","MPOL_INTERLEAVE","MPOL_LOCAL","MPOL_PREFERRED","MPOL_PREFERRED_MANY","MPOL_WEIGHTED_INTERLEAVE"],"flags":["MPOL_F_NUMA_BALANCING","MPOL_F_RELATIVE_NODES","MPOL_F_STATIC_NODES"]},"mountExtensions":{"idmap":{"enabled":true}},"netDevices":{"enabled":true}},"annotations":{"io.github.seccomp.libseccomp.version":"2.6.0","org.opencontainers.runc.checkpoint.enabled":"true","org.opencontainers.runc.commit":"v1.5.1-0-g8f2685a4","org.opencontainers.runc.version":"1.5.1"},"potentiallyUnsafeConfigAnnotations":["bundle","org.systemd.property.","org.criu.config"]}]} runc:{{runc [] map[]} map[org.opencontainers.runtime-spec.features:{"ociVersionMin":"1.0.0","ociVersionMax":"1.3.0","hooks":["prestart","createRuntime","createContainer","startContainer","poststart","poststop"],"mountOptions":["async","atime","bind","defaults","dev","diratime","dirsync","exec","iversion","lazytime","loud","mand","noatime","nodev","nodiratime","noexec","noiversion","nolazytime","nomand","norelatime","nostrictatime","nosuid","nosymfollow","private","ratime","rbind","rdev","rdiratime","relatime","remount","rexec","rnoatime","rnodev","rnodiratime","rnoexec","rnorelatime","rnostrictatime","rnosuid","rnosymfollow","ro","rprivate","rrelatime","rro","rrw","rshared","rslave","rstrictatime","rsuid","rsymfollow","runbindable","rw","shared","silent","slave","strictatime","suid","symfollow","sync","tmpcopyup","unbindable"],"linux":{"namespaces":["cgroup","ipc","mount","network","pid","time","user","uts"],"capabilities":["CAP_CHOWN","CAP_DAC_OVERRIDE","CAP_DAC_READ_SEARCH","CAP_FOWNER","CAP_FSETID","CAP_KILL","CAP_SETGID","CAP_SETUID","CAP_SETPCAP","CAP_LINUX_IMMUTABLE","CAP_NET_BIND_SERVICE","CAP_NET_BROADCAST","CAP_NET_ADMIN","CAP_NET_RAW","CAP_IPC_LOCK","CAP_IPC_OWNER","CAP_SYS_MODULE","CAP_SYS_RAWIO","CAP_SYS_CHROOT","CAP_SYS_PTRACE","CAP_SYS_PACCT","CAP_SYS_ADMIN","CAP_SYS_BOOT","CAP_SYS_NICE","CAP_SYS_RESOURCE","CAP_SYS_TIME","CAP_SYS_TTY_CONFIG","CAP_MKNOD","CAP_LEASE","CAP_AUDIT_WRITE","CAP_AUDIT_CONTROL","CAP_SETFCAP","CAP_MAC_OVERRIDE","CAP_MAC_ADMIN","CAP_SYSLOG","CAP_WAKE_ALARM","CAP_BLOCK_SUSPEND","CAP_AUDIT_READ","CAP_PERFMON","CAP_BPF","CAP_CHECKPOINT_RESTORE"],"cgroup":{"v1":true,"v2":true,"systemd":true,"systemdUser":true,"rdma":true},"seccomp":{"enabled":true,"actions":["SCMP_ACT_ALLOW","SCMP_ACT_ERRNO","SCMP_ACT_KILL","SCMP_ACT_KILL_PROCESS","SCMP_ACT_KILL_THREAD","SCMP_ACT_LOG","SCMP_ACT_NOTIFY","SCMP_ACT_TRACE","SCMP_ACT_TRAP"],"operators":["SCMP_CMP_EQ","SCMP_CMP_GE","SCMP_CMP_GT","SCMP_CMP_LE","SCMP_CMP_LT","SCMP_CMP_MASKED_EQ","SCMP_CMP_NE"],"archs":["SCMP_ARCH_AARCH64","SCMP_ARCH_ARM","SCMP_ARCH_LOONGARCH64","SCMP_ARCH_MIPS","SCMP_ARCH_MIPS64","SCMP_ARCH_MIPS64N32","SCMP_ARCH_MIPSEL","SCMP_ARCH_MIPSEL64","SCMP_ARCH_MIPSEL64N32","SCMP_ARCH_PPC","SCMP_ARCH_PPC64","SCMP_ARCH_PPC64LE","SCMP_ARCH_RISCV64","SCMP_ARCH_S390","SCMP_ARCH_S390X","SCMP_ARCH_X32","SCMP_ARCH_X86","SCMP_ARCH_X86_64"],"knownFlags":["SECCOMP_FILTER_FLAG_TSYNC","SECCOMP_FILTER_FLAG_SPEC_ALLOW","SECCOMP_FILTER_FLAG_LOG","SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV"],"supportedFlags":["SECCOMP_FILTER_FLAG_TSYNC","SECCOMP_FILTER_FLAG_SPEC_ALLOW","SECCOMP_FILTER_FLAG_LOG","SECCOMP_FILTER_FLAG_WAIT_KILLABLE_RECV"]},"apparmor":{"enabled":true},"selinux":{"enabled":true},"intelRdt":{"enabled":true,"schemata":true,"monitoring":true},"memoryPolicy":{"modes":["MPOL_BIND","MPOL_DEFAULT","MPOL_INTERLEAVE","MPOL_LOCAL","MPOL_PREFERRED","MPOL_PREFERRED_MANY","MPOL_WEIGHTED_INTERLEAVE"],"flags":["MPOL_F_NUMA_BALANCING","MPOL_F_RELATIVE_NODES","MPOL_F_STATIC_NODES"]},"mountExtensions":{"idmap":{"enabled":true}},"netDevices":{"enabled":true}},"annotations":{"io.github.seccomp.libseccomp.version":"2.6.0","org.opencontainers.runc.checkpoint.enabled":"true","org.opencontainers.runc.commit":"v1.5.1-0-g8f2685a4","org.opencontainers.runc.version":"1.5.1"},"potentiallyUnsafeConfigAnnotations":["bundle","org.systemd.property.","org.criu.config"]}]}]
Default runtime: runc
Storage driver: overlayfs
Root dir: /var/lib/docker
Server version: 29.8.2
----- running containers -----
NAMES IMAGE STATUS PORTS
albok-service gitea.phasefinal.com/pfi/albok-service:0.1.8 Up About a minute (healthy) 0.0.0.0:8392->8390/tcp, [::]:8392->8390/tcp
----- all containers -----
NAMES IMAGE STATUS
albok-service gitea.phasefinal.com/pfi/albok-service:0.1.8 Up About a minute (healthy)
----- networks -----
NAME DRIVER SCOPE
bridge bridge local
host host local
none null local
traefik-net bridge local
----- networks (external, non-default — worth knowing for compose external: true) -----
traefik-net
----- named volumes -----
VOLUME NAME DRIVER
----- compose projects currently running -----
albok-service
===== COMPOSE FILES (/opt/docker/compose/) =====
>>> /opt/docker/compose/albok-service/compose.yaml
# albok-service — the fleet knowledgebase service (vh/albok, packages/albok-service). The only
# writer of the buildings-and-wings store. Requested by albok-dev 2026-10-02 (operator-approved).
# Host: nh3-albok (VM 110 on nh3-pve-2, 10.100.50.44) since 2026-10-04, a VM that runs ONLY this.
# It moved off nh3-docker, where portainer/dockge/the agent and dockerd on tcp/2375 were all root
# over the store (servers/nh3-albok/README.md).
#
# Deploy: scripts/elway infra-ops@10.100.50.44 --playbook playbooks/albok-service-host.yaml (host prep, config)
# scripts/deploy-stack.sh nh3-albok albok-service (this file + conf/)
# Image: built from a clean `git archive` of vh/albok, pushed to the pfi org (see README.md).
#
# ⚠ Host port 8392 (kept from nh3-docker, where 8390 was the post office) so clients did not change.
# ⚠ Exactly ONE instance per private root: a second one exits 75 on the lease. Never scale this.
# ⚠ Nothing else may mount /srv/albok/store read-write. Viewers mount it :ro with group_add by gid
# (1510 albok-read, 1511 albok-personal) and need GIT_OPTIONAL_LOCKS=0 + a safe.directory entry.
# 1512 albok-feedback (restricted wing personal/agent-feedback) is default-deny: no viewer gets it.
services:
albok-service:
image: gitea.phasefinal.com/pfi/albok-service:0.1.8@sha256:239f900ee39a26414f34afe9b7583253986d838df9988228fab1039d18c414df
container_name: albok-service
restart: unless-stopped
ports:
- "8392:8390"
# Membership the service needs to chgrp wing dirs to the read groups (it runs as uid 1500, not root).
group_add:
- "1510"
- "1511"
- "1512" # albok-feedback: restricted wing personal/agent-feedback
volumes:
- /srv/albok/store:/srv/albok/store
- /srv/albok/private:/srv/albok/private
- /srv/albok/etc/albok.yaml:/etc/albok/albok.yaml:ro
# the read groups must RESOLVE BY NAME inside the container (layout.py uses grp.getgrnam)
- /opt/docker/conf/albok-service/group:/etc/group:ro
mem_limit: 8g # 4g on nh3-docker (7.7 GiB shared host); 12 GiB VM to itself now
healthcheck:
test: ["CMD", "python", "-c", "import urllib.request,sys; sys.exit(0 if urllib.request.urlopen('http://127.0.0.1:8390/health', timeout=5).status == 200 else 1)"]
interval: 30s
timeout: 10s
retries: 3
start_period: 60s
networks:
- tnet
# No homepage.* labels: Homepage discovers containers over a host's tcp/2375, and this host must not
# expose its Docker API. The Albok tile is a static entry in stacks/homepage/conf/services.yaml.
networks:
tnet:
name: traefik-net
external: true
===== CONFIG LAYOUT (/opt/docker/conf/ — top 200 entries) =====
/opt/docker/conf
/opt/docker/conf/albok-service
/opt/docker/conf/albok-service/albok.yaml.template
/opt/docker/conf/albok-service/group
===== LISTENING PORTS =====
0.0.0.0:22
0.0.0.0:5355
0.0.0.0:8392
127.0.0.53%lo:53
127.0.0.54:53
[::]:22
[::]:5355
[::]:8392
===== MODEL / HUGGINGFACE CACHES =====
===== DOCKER-ADJACENT SYSTEMD SERVICES =====
containerd.service running
docker.service running
===== DONE =====
Paste the above back into the chat, or pass a path as argv[1] to save.
Reference in New Issue View Git Blame Copy Permalink