vh
e369b1c769
svos-dev: the service worker fetches its hash-pinned INVENTORY with credentials omitted. Exactly those files plus /sw.js are now served before basic_auth (GET/HEAD, exact files). The list is generated from the release's sw.js by svos-front-inventory, which hash-checks each file and validates before reload. Gated static routes follow the web/README hosting contract: missing assets 404 instead of index.html, other document requests get index.html, everything else 404, unversioned files no-cache. acceptance-matrix.sh: 35/35 live; 16 FAIL against the previous config (positive control). git added to the nh3-svos playbook (kernel's remote check). Live backup drill: quiesced backup ~1-2 s outage; a refused freeze does NOT abort vzdump (unfrozen backup, job reported successful); both images restore-mounted read-only and verified.
82 lines
4.0 KiB
YAML
82 lines
4.0 KiB
YAML
# Base build for nh3-svos (VM 111 on nh3-pve-2, 10.100.50.43): the host for the NEW SVOS operating system
|
|
# (corviduo/svoperatingsystem). Requested by svos-dev relaying Prime, 2026-10-05. A SEPARATE instance: the existing
|
|
# High Seat (svos.service on nh3-dev :8770) and Miranda are untouched.
|
|
# scripts/elway infra-ops@10.100.50.43 --playbook playbooks/nh3-svos-host.yaml
|
|
# Order: nh3-pve-2-cloudinit-vm.yaml (on nh3-pve-2) → bootstrap-infra-ops-user.yaml AS vh → this.
|
|
#
|
|
# Infra owns the box; svos-dev owns the application (install, config, enrollment, acceptance). What this provides:
|
|
# - service account `svc-svos` (uid/gid 801, nologin; fleet-conventions § 1.3), the only writer of the data root
|
|
# - /var/lib/svos svc-svos 0700, LOCAL ext4 (the root disk on vmstore): SQLite WAL, one writer, never shared/NFS
|
|
# - /opt/svos root:svc-svos 2775, the release tree (releases/<id>/ + a `current` link; svos-dev lays it out)
|
|
# - Python 3.13 (Debian 13) + venv, sqlite3, qemu-guest-agent (vzdump freeze/thaw), timesyncd checked
|
|
# - git: the SVOS kernel's data-root production-remote check needs it (svos-dev, 2026-10-05); no checkout lives here
|
|
# - /etc/qemu/fsfreeze-hook.d/ exists for the application-consistent snapshot hook svos-dev will add (the guest
|
|
# agent runs those scripts on vzdump's freeze/thaw)
|
|
# No Docker: nothing here needs it.
|
|
steps:
|
|
- name: take the bootstrap infra-ops key back off vh (vh keeps the operator's keys)
|
|
sudo: true
|
|
shell: |
|
|
set -e
|
|
f=/home/vh/.ssh/authorized_keys
|
|
grep -v 'infra-ops@pfi-fleet' "$f" > "$f.new"
|
|
test -s "$f.new"
|
|
chown vh:vh "$f.new"; chmod 600 "$f.new"; mv "$f.new" "$f"
|
|
when: "sudo -n grep -q 'infra-ops@pfi-fleet' /home/vh/.ssh/authorized_keys"
|
|
|
|
- name: timezone America/Los_Angeles
|
|
sudo: true
|
|
shell: timedatectl set-timezone America/Los_Angeles
|
|
when: "[ \"$(timedatectl show -p Timezone --value)\" != America/Los_Angeles ]"
|
|
|
|
- name: base packages
|
|
sudo: true
|
|
shell: DEBIAN_FRONTEND=noninteractive apt-get install -y -q qemu-guest-agent python3 python3-venv sqlite3 rsync jq curl ca-certificates git
|
|
when: "! dpkg -s qemu-guest-agent python3-venv sqlite3 rsync jq git >/dev/null 2>&1"
|
|
|
|
- name: qemu-guest-agent running
|
|
sudo: true
|
|
shell: systemctl start qemu-guest-agent
|
|
when: "! systemctl is-active --quiet qemu-guest-agent"
|
|
|
|
- name: fsfreeze hook directory for the application-consistent snapshot hook
|
|
sudo: true
|
|
shell: install -d -o root -g root -m 0755 /etc/qemu/fsfreeze-hook.d
|
|
changed_when: "false"
|
|
|
|
- name: service account svc-svos (uid/gid 801, nologin, home = the data root)
|
|
sudo: true
|
|
shell: |
|
|
set -e
|
|
getent group 801 >/dev/null && { echo "gid 801 taken"; exit 1; }
|
|
getent passwd 801 >/dev/null && { echo "uid 801 taken"; exit 1; }
|
|
groupadd --system --gid 801 svc-svos
|
|
useradd --system --uid 801 --gid 801 --shell /usr/sbin/nologin --home-dir /var/lib/svos --no-create-home svc-svos
|
|
when: "! getent passwd svc-svos >/dev/null"
|
|
|
|
- name: data root /var/lib/svos (svc-svos 0700) and release tree /opt/svos (root:svc-svos 2775)
|
|
sudo: true
|
|
shell: |
|
|
install -d -o svc-svos -g svc-svos -m 0700 /var/lib/svos
|
|
install -d -o root -g svc-svos -m 2775 /opt/svos /opt/svos/releases
|
|
changed_when: "false"
|
|
|
|
verify:
|
|
- name: identities are the fleet pins
|
|
shell: |
|
|
test "$(id -u vh)" = 1000 && test "$(id -u infra-ops)" = 850 && test "$(id -u svc-svos)" = 801
|
|
changed_when: "false"
|
|
- name: vh no longer carries the infra-ops key
|
|
sudo: true
|
|
shell: "! grep -q 'infra-ops@pfi-fleet' /home/vh/.ssh/authorized_keys"
|
|
changed_when: "false"
|
|
- name: data root is local ext4 and private
|
|
sudo: true
|
|
shell: |
|
|
test "$(findmnt -T /var/lib/svos -no FSTYPE)" = ext4 && test "$(stat -c '%U %a' /var/lib/svos)" = "svc-svos 700"
|
|
changed_when: "false"
|
|
- name: python, sqlite, guest agent, time sync
|
|
shell: |
|
|
python3 --version && sqlite3 --version | cut -c1-20 && systemctl is-active qemu-guest-agent && timedatectl show -p NTPSynchronized --value
|
|
changed_when: "false"
|