61 lines
4.5 KiB
Markdown
61 lines
4.5 KiB
Markdown
# nh3-albok: the albok-service host (VM 110 on nh3-pve-2, NH3)
|
||
|
||
A VM that runs **only** `albok-service`, the fleet knowledgebase (`stacks/albok-service/`). Built 2026-10-04 at
|
||
albok-dev's request, relaying Prime (~2235): albok moved off nh3-docker before unit 4 puts the operator's personal
|
||
vault and licensed books into restricted wings.
|
||
|
||
**Why it has its own VM.** On nh3-docker, four things were root over `/srv/albok`, restricted wings included:
|
||
portainer, portainer_agent and dockge (docker socket read-write), and dockerd itself on plaintext **tcp/2375**
|
||
for Homepage discovery, reachable from the whole LAN. Memory was the second reason: albok sat at 2.4 of a 4 GiB
|
||
cap on a 7.7 GiB host shared with the post office and AdGuard, so a reindex under pressure could take DNS or the
|
||
bus with it. Unit 6 (encrypted wings keyed from the vault) also wants a host whose only tenant is albok.
|
||
|
||
| | |
|
||
|---|---|
|
||
| Address | `10.100.50.44`, VLAN 50 (nh3-servers), static via cloud-init; `nh3-albok.nh3.internal`. Service alias `albok.nh3.internal` points here |
|
||
| Guest | VM **110** on **nh3-pve-2** (first guest there). `onboot 1`, tag `albok` |
|
||
| Shape | 4 vCPU `x86-64-v3` (AVX2; still restorable on nh3-pve's i9-13900H), 12 GiB, 100 GB `vmstore` (LVM-thin, discard on), virtio-scsi-single + iothread |
|
||
| OS | Debian 13 genericcloud + cloud-init; Docker CE 29.8 from Docker's repo |
|
||
| Identities | `vh` 1000 (operator keys), `infra-ops` 850 (NOPASSWD sudo, `log_output`, BULK_DATA exempt), `docker` gid 851; albok ids 1500/1510/1511/1512 (see the stack README) |
|
||
| Service | `albok-service` on host **8392** → container 8390, `mem_limit 8g`. `/srv/albok/{store,private,etc}` on the root ext4 |
|
||
| Backups | nh3-pve-2 vzdump job, nightly **2130**, snapshot mode → **pbs-ana**, namespace **`nh3-pve-2`**; pbs-nh3's 0630 sync mirrors it |
|
||
|
||
## ⚠ Keep it single-tenant
|
||
|
||
The point of this host is that nothing else can reach the store as root. So:
|
||
|
||
- **No** portainer, dockge, beszel-agent-with-socket or any container that mounts `/var/run/docker.sock`.
|
||
- **No** `-H tcp://` on dockerd. Homepage therefore cannot discover it; the Albok tile is a **static** entry in
|
||
`stacks/homepage/conf/services.yaml`. Do not add this host to `stacks/homepage/conf/docker.yaml`.
|
||
- **Nothing else mounts `/srv/albok/store` read-write.** Viewers follow the rules in the stack README.
|
||
- Who is root here anyway: anyone with root on **nh3-pve-2** (reads the disk), the **PBS** datastores (backups are
|
||
not client-side encrypted), and the `vh` / `infra-ops` sudoers. That circle is the residual exposure.
|
||
|
||
## Build (reproducible)
|
||
|
||
```bash
|
||
scripts/elway infra-ops@10.100.250.62 --playbook playbooks/nh3-pve-2-vmbr0-vlan-aware.yaml # once, then reboot nh3-pve-2
|
||
scripts/elway infra-ops@10.100.250.62 --playbook playbooks/nh3-albok-vm.yaml # VM 110 + cloud-init
|
||
scripts/elway vh@10.100.50.44 --playbook playbooks/bootstrap-infra-ops-user.yaml # infra-ops 850, as vh
|
||
scripts/elway infra-ops@10.100.50.44 --playbook playbooks/nh3-albok-host.yaml # docker, tree, takes the bootstrap key off vh
|
||
scripts/elway infra-ops@10.100.50.44 --playbook playbooks/albok-service-host.yaml # albok ids + /srv/albok
|
||
# then the stack README's deploy steps (config, deploy-stack.sh nh3-albok albok-service, registry login, up -d)
|
||
```
|
||
|
||
Registry: root is logged in to `gitea.phasefinal.com` as `claude-bot` with the vaulted
|
||
`nh3-dev/.config/claude-bot/gitea-token`, the same credential nh3-docker's root uses (matched by hash, 2026-10-04).
|
||
|
||
## Move from nh3-docker (2026-10-04)
|
||
|
||
The store, private root and config moved as one `tar` stream (`--format=posix --numeric-owner --xattrs --acls`,
|
||
both ends under `sudo /usr/bin/tar`, which the BULK_DATA rule keeps out of the sudo-io recordings). It was checked
|
||
by a manifest digest (path, uid, gid, mode, size, mtime, type) and a content-hash digest compared on both ends.
|
||
Only digests were printed, so the restricted wings' paths never reached a terminal or a recording.
|
||
|
||
On nh3-docker the container was removed and `compose.yaml` renamed to
|
||
`compose.yaml.moved-to-nh3-albok-2026-10-04`, so a stray `compose up` there cannot start a second writer on a stale
|
||
copy. albok-dev's acceptance passed at 0018 on 2026-10-05 (albok-check twice, then a clean Nemi walk), and the old
|
||
`/srv/albok` on nh3-docker was deleted at 0018 on Prime's approval. Old nh3-docker backups still hold that copy until
|
||
their retention ages it out. The personal vault was never ingested there, so those backups do not contain it.
|
||
First backup of VM 110: 2026-10-05 0019–0021 by hand, 1 m 55 s, guest-agent freeze/thaw OK.
|